QwikSec

Security Database

CVE

CWE

Training

CVE-2025-27135

Published: Feb 25, 2025

Modified: Feb 25, 2025

PUBLISHED

Description

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query. As of time of publication, no patched version is available.

Vendor	Product	Versions
infiniflow	ragflow	affected `<= 0.15.1`

Weaknesses (CWE)

References

https://github.com/infiniflow/ragflow/security/advisories/GHSA-3gqj-66qm-25jq

x_refsource_CONFIRM

https://github.com/infiniflow/ragflow/blob/v0.15.1/agent/component/exesql.py

x_refsource_MISC

https://swizzky.notion.site/ragflow-exesql-150ca6df7c03806989cefde915cf8e42?pvs=4

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.