RAGFlow Prompt Generator Server-Side Template Injection Leads to Remote Code Execution

Unsandboxed Jinja2 Environment in citation_prompt() lets any authenticated user pop a shell via a DuckDuckGo→LLM Canvas workflow

RAGFlow, an open-source Retrieval-Augmented Generation engine from infiniflow, contains a critical server-side template injection in versions 0.24.0 and earlier. The prompt generator (rag/prompts/generator.py) renders user-supplied citation guidelines through an unsandboxed Jinja2 environment. Any authenticated user — including a self-registered, low-privilege account — can build a Canvas workflow chaining a DuckDuckGo tool into an LLM component, embed a Jinja2 payload in the prompt, and execute arbitrary OS commands on the RAGFlow server with the service's own privileges. Fixed in v0.25.0 by switching to jinja2.sandbox.SandboxedEnvironment.