CVE-2026-58579: RAGFlow Agent Pipeline XSS – Stored JavaScript Injection in Node Names

Technical summary

The vulnerability stems from a multi-stage sanitization failure. The agent update endpoint calls normalize_dsl to validate the DSL structure, but this function only performs JSON serialization checks and does not sanitize the node name field itself. When the dataflow-result UI renders the confirmation modal for the "Rerun from current step" action, it uses React's dangerouslySetInnerHTML to inject the node name directly into the DOM. Compound with the i18next internationalization library configured with escapeValue:false, HTML entities are not encoded, allowing arbitrary HTML and JavaScript to be rendered. An attacker crafts a malicious node name containing script tags or event handlers, saves the agent pipeline, and when a colleague opens the dataflow result and initiates a rerun, the injected script executes in their browser context with their authentication tokens available.

Business impact

This vulnerability enables lateral privilege escalation and account compromise within RAGFlow workspaces. An insider with agent editing permissions can target colleagues to steal session tokens, manipulate data, or perform actions on their behalf. Because the attack vector is stored and triggers on user interaction rather than requiring social engineering outside the application, it has higher conversion rates than transient XSS. Organizations using RAGFlow for collaborative AI workflows may face unauthorized data access, modification of AI pipelines, or credential compromise affecting downstream systems that these users have permission to access.

Affected systems

RAGFlow versions 0.26.2 and earlier are affected. The issue is fixed in version 0.26.3 and later. Any deployment where workspace members can create or edit agent pipelines is at risk if users from untrusted or semi-trusted teams share the same workspace. The vulnerability does not affect read-only workspace members or users without agent editing privileges.

Exploitability

Exploitability is moderate. The attacker must have authenticated workspace access and agent editing permissions—not a low bar in organizations where multiple teams collaborate on RAGFlow. The victim must open a dataflow result page and click the rerun confirmation, which is normal operational behavior for pipeline management. No advanced exploitation techniques are required; a simple payload injected into the node name field will execute. However, the attack is not wormable (it does not self-propagate) and requires per-victim interaction.

Remediation

Organizations should upgrade RAGFlow to version 0.26.3 or later immediately. The patch properly sanitizes node names before rendering in the UI by enabling HTML encoding. During the patch window, restrict agent editing permissions to a minimal trusted group, monitor audit logs for pipeline modifications, and educate users not to click rerun on unfamiliar or suspicious dataflow results. For defense-in-depth, apply content security policies (CSP) to the RAGFlow application deployment to restrict inline script execution.

Patch guidance

Verify the specific patch version available for your deployment through the RAGFlow project releases. Version 0.26.3 addresses this vulnerability and is available as a direct upgrade. Before patching, back up any custom agent pipelines or configurations. Test the upgrade in a non-production environment first. After patching, verify that existing pipelines continue to function correctly and that the node name rendering no longer displays raw HTML or script tags. No database migrations or post-patch configuration changes are typically required for this fix.

Detection guidance

Review RAGFlow audit logs for agent pipeline modifications, particularly changes to node names that contain suspicious characters such as angle brackets, quotes, or event handler prefixes (on*, javascript:). Examine stored pipeline definitions in the backend database or configuration files for node names that include HTML or JavaScript patterns. Monitor browser console logs and network activity on RAGFlow UI deployments for execution of unexpected scripts. Consider deploying a web application firewall (WAF) rule to detect stored XSS payloads in agent pipeline submission requests, flagging node names containing script tags or HTML event handlers.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), the vulnerability should be treated as a higher priority for most organizations. The attack requires only authenticated access within a normal operational workflow, the payload is trivial to craft, and successful exploitation directly leads to account takeover—a business-critical outcome. Workspaces with diverse teams or contractors warrant faster patching. Organizations with strict separation of duties and infrequent inter-team collaboration can accept a slightly longer timeline, but no later than the end of the current sprint cycle.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects the attack vector (network, requires authentication), low attack complexity, and requirement for user interaction. However, the impact—confidentiality and integrity loss through token theft and account takeover—is high in business terms. The scope change from C (confidence/unchanged) to S (changed, affecting resources outside the security scope) recognizes that compromised accounts can access systems and data beyond the immediate workspace. Organizations should weight this score against their threat model: if RAGFlow is used for sensitive AI/ML operations or regulatory compliance work, consider internal risk governance as HIGH despite the CVSS MEDIUM rating.

Frequently asked questions