Vulnerability Description
RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/infiniflow/ragflow/commit/572f1ea9f4eba6a60e64f7437dee60aa1c0
- https://github.com/infiniflow/ragflow/issues/16507
- https://github.com/infiniflow/ragflow/pull/16516
- https://github.com/infiniflow/ragflow/releases/tag/v0.26.3
- https://www.vulncheck.com/advisories/ragflow-stored-cross-site-scripting-via-age
FAQ
What is CVE-2026-58579?
CVE-2026-58579 is a vulnerability with a CVSS score of 5.4 (MEDIUM). RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization va...
How severe is CVE-2026-58579?
CVE-2026-58579 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58579?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.