---
id: CVE-2026-58579
title: RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name
summary: >-
  RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without
  sanitization: the agent update endpoint normalizes the submitted DSL via
  normalize_dsl, which only performs JSON serialization validation and preserves
  the node name …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: infiniflow
product: ragflow
affected:
  - ragflow < 0.26.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-06T13:32:36.273287Z'
exploitAvailable: true
published: '2026-07-02'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:11.253Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58579'
references:
  - url: 'https://github.com/infiniflow/ragflow/releases/tag/v0.26.3'
    label: ragflow 0.26.3 Release Notes
  - url: 'https://github.com/infiniflow/ragflow/issues/16507'
    label: Researcher Disclosure
  - url: 'https://github.com/infiniflow/ragflow/pull/16516'
    label: Fix PR
  - url: >-
      https://github.com/infiniflow/ragflow/commit/572f1ea9f4eba6a60e64f7437dee60aa1c0913f1
    label: Fix Commit
  - url: >-
      https://www.vulncheck.com/advisories/ragflow-stored-cross-site-scripting-via-agent-pipeline-node-name
tags:
  - cve.org
  - exploit-available
epss: 0.00298
epssPercentile: 0.22678
ingestedAt: '2026-11-08T14:51:22.289Z'
---

## Overview

RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent update endpoint normalizes the submitted DSL via normalize_dsl, which only performs JSON serialization validation and preserves the node name verbatim. The dataflow-result web UI then renders that name into the "Rerun from current step" confirmation modal via dangerouslySetInnerHTML, and the i18next configuration sets escapeValue:false, so the value is inserted into the DOM without HTML encoding. An authenticated workspace user who can create or edit an agent can inject arbitrary JavaScript that executes in the session of another workspace member who opens the dataflow result and clicks rerun, enabling session/token theft and account takeover across the user trust boundary.

## Affected

- `ragflow < 0.26.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.