CVE-2026-121928 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
RAGFlow, an open-source retrieval-augmented generation platform, has a cross-site scripting flaw in its Images API file handling (api/utils/file_utils.py) in versions up to 0.27.2. An attacker can run scripts in a user's browser session by sending a crafted request, and the sources say a public exploit exists.
first public Nov 4, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that self-host RAGFlow up to 0.27.2 and expose its web interface or Images API to users or networks beyond their own. The sources do not say whether authentication is required to reach the Images API, and the exploit is described as publicly available.
Not affected if version-0.27.3-or-later
Who cares ai-apps, ragflow, self-hosted
0.27.2; anything at or below it is in range.0.27.3 (the sources cite patch 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c).A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.27.3 is capable of addressing this issue. The identifier of the patch is 9ea0246f8d453a144fb4f903d163b2ba6b91ed2c. Upgrading the affected component is advised.
This page as .md · .json · in your agent: get_signal("CVE-2026-121928") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.