This vulnerability is a server‑side template injection (SSTI) in RAGFlow’s prompt generator that allows an authenticated user to execute arbitrary OS commands on the host. The flaw resides in a Jinja2 template that is injected via user‑controlled input. An attacker can register an account, create a Canvas workflow with a DuckDuckGo + LLM component chain, and trigger the injection to run any command with the privileges of the RAGFlow process, leading to full compromise of the server.

The RAGFlow open‑source engine from InfinityFlow, versions 0.24.0 and earlier, is affected.

The CVSS score of 9.9 indicates critical severity. EPSS data is unavailable, but the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack requires authentication, but once authenticated an attacker can use the prompt generator to execute commands. The lack of a public exploit for this SSTI points to a high likelihood that the vulnerability remains unexploited so far, yet it presents a broad impact if abused.