RAGFlow before 0.26.3 stores agent pipeline DSL node names without sanitization. The update endpoint normalizes the DSL only via JSON validation, preserving the node name verbatim. When the dataflow‑result web UI renders the name into the “Rerun from current step” confirmation modal using dangerouslySetInnerHTML and i18next configured to not escape HTML, an attacker can inject arbitrary JavaScript. Executed in the victim’s browser, this script can read session cookies or other sensitive data, leading to session token theft and potential account takeover of the victim. The flaw maps to CWE‑79 (Cross‑Site Scripting).

The affected product is RAGFlow from infiniflow. All releases earlier than version 0.26.3 are vulnerable. Any workspace that allows users to create or edit an agent pipeline exposes the flaw, because the node names are persisted in the database and later rendered in the UI. Users who have permission to modify pipelines can inject malicious node names, and any workspace member who opens the dataflow result page and clicks the rerun button becomes a victim.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1 % signifies a very low but non‑zero likelihood of real‑world exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires an authenticated attacker with permission to edit agent pipelines and a second user who voluntarily visits the dataflow‑result page and triggers the rerun action. When both conditions are satisfied, the injected script executes in the victim’s browser, permitting theft of session tokens and the possibility of full account takeover.