Stored XSS in RAGFlow Agent Pipeline via Unsanitized Node Names

Executive Summary

CVE-2026-58579 is a stored cross-site scripting (XSS) vulnerability in RAGFlow versions before 0.26.3. It occurs because agent pipeline node names are stored without sanitization and later rendered in the web UI's "Rerun from current step" confirmation modal using dangerouslySetInnerHTML. The i18next configuration disables HTML escaping, so malicious JavaScript embedded in node names executes in the browsers of other workspace users who view the modal and click rerun.

An authenticated user with permission to create or edit agents can inject arbitrary JavaScript code into the node name. When another user opens the dataflow result and triggers the rerun modal, the injected script runs in their session, potentially leading to session or token theft and account takeover.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored cross-site scripting (XSS) via unsanitized agent pipeline node names in the RAGFlow web application. Detection involves identifying if any agent pipeline node names contain malicious JavaScript payloads that could execute when rendered in the dataflow-result web UI.

To detect exploitation attempts or presence of malicious node names, you can inspect the stored agent pipeline configurations for suspicious script tags or event handlers in node names.

Suggested commands to detect potentially malicious node names include searching the database or configuration files for suspicious patterns such as <script> tags or onerror/onload event handlers.

• If agent pipeline data is stored in a database, run a query to find node names containing script tags or suspicious HTML, for example (SQL): SELECT * FROM agents WHERE node_name LIKE '%<script%' OR node_name LIKE '%onerror=%' OR node_name LIKE '%onload=%';
• If agent pipeline configurations are stored as JSON files, use command-line tools like grep or jq to search for suspicious strings, e.g.: grep -i -E '<script|onerror=|onload=' *.json
• Monitor web application logs for unusual activity related to the 'Rerun from current step' confirmation modal or for suspicious user actions involving agent creation or updates.

Note that detection requires authenticated access to the workspace and the ability to inspect agent definitions or logs, as the vulnerability is exploitable only by authenticated users who can create or edit agents.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the execution of arbitrary JavaScript in the browser sessions of other workspace members. Specifically, it enables attackers to steal session tokens or authentication credentials.

As a result, an attacker can perform account takeover attacks across user trust boundaries within the workspace, compromising user accounts and potentially gaining unauthorized access to sensitive data or functionality.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to inject arbitrary JavaScript that can execute in other users' sessions, potentially leading to session/token theft and account takeover. Such unauthorized access and data compromise can violate data protection and privacy requirements under standards like GDPR and HIPAA, which mandate safeguarding user data and preventing unauthorized access.

Because the vulnerability enables cross-site scripting (XSS) attacks that can lead to account compromise and data exposure, it poses a risk to confidentiality and integrity of sensitive information, which are core principles in compliance frameworks such as GDPR and HIPAA.

Mitigating this vulnerability by sanitizing user input and output, as done in the fixed versions, helps maintain compliance by reducing the risk of unauthorized data access and protecting user sessions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the CVE-2026-58579 vulnerability, you should upgrade RAGFlow to version 0.26.3 or later, where the issue has been fixed.

The fix involves sanitizing the agent pipeline node names before rendering them in the "Rerun from current step" confirmation modal using the DOMPurify library, which strips unsafe HTML tags and attributes to prevent script execution.

Additional mitigation steps include enabling HTML escaping globally in the i18next configuration or stripping HTML from node names during server-side processing to prevent injection of malicious scripts.

Ensure that only authenticated and authorized users can create or edit agents, as the vulnerability requires such permissions to inject malicious payloads.

Useful 0 Not Useful 0