What’s Vulnerable › Vulnerabilities
CVE-2024-10131: Remote Code Execution in infiniflow/ragflow
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2024-10-19 · updated 2026-06-17
- Weakness: CWE-94
Description
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.
Affected products
- infiniflow ragflow: 0.11.0
References
Get alerted when CVE-2024-10131 or the next vulnerability affects your stack