No fixed build is published yet. The vendor describes a workaround.
Steps
Written by AI from the record
Check whether your deployment uses RAGFlow and whether its version is 0.24.0 or earlier.
Verify which accounts (and authentication method) can access the Agent workflow “Text Processing” / template-like features.
If you are affected and no patch is available for your version, immediately restrict access so only the minimum trusted accounts can reach RAGFlow (and especially the Agent workflow endpoints involved).
If possible in your setup, disable or remove the Agent “Text Processing” workflow (StringTransform) and any Message/template rendering functionality until a fixed version is available.
Re-check after any vendor update or rebuild whether a fixed release exists for your exact RAGFlow version branch, and upgrade as soon as a patch becomes available.
RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These components use Python's jinja2.Template (unsandboxed) to render user-supplied templates, allowing any authenticated user to execute arbitrary operating system commands on the server. At time of publication, there are no publicly available patches.
In plain language
Written by AI from the record
CVE-2026-28797 is a RAGFlow bug where an authenticated user can inject instructions into a template feature and cause the server to run commands; small businesses running RAGFlow (especially older versions up to 0.24.0) should treat this as actively dangerous.
In RAGFlow, an authenticated Server-Side Template Injection (SSTI) in the Agent “Text Processing” (StringTransform) and Message components lets a user supply a template that is rendered by unsandboxed jinja2.Template, enabling Remote Code Execution (RCE) on the server.
If you're affected
Server takeover via command execution
Data theft from the RAGFlow host
Ransomware risk from full compromise
Service disruption and downtime
What is it
RAGFlow is used to power retrieval-augmented generation (a kind of AI assistant that pulls in information before responding). This bug lets someone who can log in to the system “hide” malicious instructions inside a template the server renders, tricking the server into running commands as if they were part of the template. In practice, that can mean full compromise of the machine running RAGFlow.
Who is affected
This matters to you if you run RAGFlow and have the Agent workflow “Text Processing” (StringTransform) and/or Message template rendering enabled. It’s especially relevant for RAGFlow versions 0.24.0 and earlier.
This is a risk primarily when an attacker already has an authenticated way to reach the relevant RAGFlow functionality (it is not described as purely unauthenticated internet exposure).
How urgent is it
This is RED because exploitation is being reported, and press attention is explicitly rising due to active misuse by an actor (Qilin). Even though no public exploit code was found in the provided sources, confirmed exploitation signals attackers are successfully using this weakness.
Do not wait for a patch timeline—focus first on limiting who can access the affected Agent workflow endpoints and disabling the vulnerable functionality if you can.
What to do — in detail
Confirm if you’re exposed
Identify your RAGFlow version. If it is 0.24.0 or earlier, you are in the affected range.
Determine whether your RAGFlow instance uses the Agent workflow “Text Processing” (StringTransform) and/or the Message component that renders templates.
List who can access the authenticated features that submit or control those agent/template inputs (for example: internal users, API clients, service accounts).
Contain immediately (until a fixed release exists)
Restrict access to RAGFlow to the smallest set of trusted users/accounts.
If your architecture allows it, block access from the internet entirely and only allow traffic from trusted networks/VPNs.
If you can configure features, disable or remove the Agent “Text Processing” (StringTransform) workflow and any Message/template rendering that could render user-supplied templates.
Patch / upgrade
The provided sources say no fix/patch information is available yet. That means you should not assume an update exists for your current version.
When a fixed version becomes available, upgrade promptly to the version stated by the vendor/advisories for CVE-2026-28797, and validate the configuration is no longer using the vulnerable template rendering path.
What to monitor
Look for suspicious command execution indicators on the RAGFlow host (unexpected processes spawned by the service, unusual outbound connections, or new system users/files created around the time of agent usage).
Review access logs for authenticated requests that interact with the Agent “Text Processing” / Message template features, especially any that attempt to include template-like payloads.
Timing note
There is no KEV entry listed in the provided sources and no public fixed version information here, so treat this as an active-threat containment-and-upgrade workflow rather than a “wait for KEV” plan.
Technical context
What’s happening
Vulnerability type: Server-Side Template Injection (CWE-20) with related templating weaknesses (CWE-78, CWE-94, CWE-1336).
Mechanism: In affected RAGFlow versions (0.24.0 and prior), the Agent workflow “Text Processing” (StringTransform) and Message components render user-controlled templates using Python’s jinja2.Template without sandboxing.
Result: A user who can submit/control the template input can trigger Remote Code Execution (RCE) by making the server execute operating system commands.
Exploitation status
KEV: Not listed in CISA KEV (based on the provided findings).
Public exploit code: No public exploit code on record (based on the provided findings).
Exploitation signal: Press attention is rising specifically because exploitation is occurring, and the actor is reported as Qilin.
Risk drivers
Access requirements: The issue is described as exploitable by an authenticated user (consistent with PR:L and the workflow-based nature of agent/template inputs).
Attack surface: The template rendering in the Agent “Text Processing” and Message components.
Fix availability
Patch information: The provided findings report that no fix/patch information is available yet.
Scoring context
The provided EPSS is a prediction only (and is not used as a substitute for confirmed exploitation signals).
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
