Infiniflow - Ragflow - CRITICAL - CVE-2026-45312. RAGFlow, an open-source engine focused on Retrieval-Augmented Generation, contains a vulnerability due to improper handling of Jinja2 templates in the prompt generator. Users with authentication can exploit this flaw to execute arbitrary operating system commands on the server. This allows a registered user to create a workflow that incorporates a DuckDuckGo search and LLM component chain, leading to server-side template injection (SSTI). The vulnerability is present in version 0.24.0 and earlier, posing a significant risk to server integrity.