RAGFlow’s Agent workflow components – specifically Text Processing (StringTransform) and Message – render user‑supplied templates via Python’s Jinja2.Template without sandboxing. This Server‑Side Template Injection flaw allows any authenticated user to inject crafted Jinja2 expressions that are evaluated as operating‑system commands, giving the attacker arbitrary command execution on the RAGFlow host. The resulting breach can lead to data exfiltration, service disruption, or further compromise of the underlying infrastructure.

Infiniflow’s open‑source RAGFlow engine, versions 0.24.0 and earlier, is affected. The vulnerability resides in the Text Processing and Message components of the Agent workflow, and any authenticated user who can submit or edit templates is at risk.

The CVSS score of 8.7 denotes a high‑severity flaw, while the EPSS score is not currently available, leaving the real‑world exploitation probability unclear. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the workflow UI and the ability to inject Jinja2 code; once injected, the attacker can run commands with the same privileges as the RAGFlow process.