Repository navigation
Security: infiniflow/ragflow
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
OpenAI-compatible agent completion bypasses private canvas authorizationGHSA-c6q8-23rp-32cv published
Oct 5, 2026 by yingfengHigh -
Server-Side Template Injection in Prompt Generator leads to Remote Code ExecutionGHSA-wpg4-h5g2-jxm6 published
May 9, 2026 by yingfengCritical -
Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" ComponentGHSA-vvwj-fvwh-4whx published
Apr 1, 2026 by yingfengCritical -
[RF-01] Zip Slip Remote Code Execution (RCE) in MinerUParserGHSA-v7cf-w7gj-pgf4 published
Jan 27, 2026 by yingfengCritical -
RAGFlow Remote Code Execution VulnerabilityGHSA-8xw3-v6c2-j84j published
Dec 31, 2025 by yingfengHigh -
Predictable Token Generation Leading to Authentication Bypass VulnerabilityGHSA-9j5g-g4xm-57w7 published
Dec 31, 2025 by yingfengCritical -
There is an SQL injection vulnerability in ragflow.GHSA-3gqj-66qm-25jq published
Feb 25, 2025 by KevinHuShCritical -
Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflowGHSA-wc5v-g79p-7hch published
Feb 21, 2025 by KevinHuShHigh
Learn more about advisories related to infiniflow/ragflow in the GitHub Advisory Database