RAGFlow: Unsafe pickle.loads() in deserialize_b64() Disabled by Default Safety Mechanism in infiniflow/ragflow

closed

Reported on Mar 8th 2026

Description

RAGFlow's deserialize_b64() function calls Python's unrestricted pickle.loads() by default. The safety mechanism (RestrictedUnpickler) is gated behind a configuration flag use_deserialize_safe_module that defaults to False. This function is called from the ORM layer whenever a SerializedField (which defaults to PICKLE type) is read from the database. An attacker who can inject a crafted pickle payload into any serialized database column achieves RCE on the RAGFlow server.

Affected Code

File:api/utils/configs.py:53-61

def deserialize_b64(src):
    src = base64.b64decode(src)
    use_deserialize_safe_module = get_base_config('use_deserialize_safe_module', False)
    if use_deserialize_safe_module:
        return restricted_loads(src)
    return pickle.loads(src)  # UNRESTRICTED by default

File:api/db/db_models.py:99 -- SerializedField defaults to PICKLE type, meaning all SerializedField columns in the ORM use this unsafe deserialization path.

Secondary Issue

Even when use_deserialize_safe_module=True, the RestrictedUnpickler whitelists the entire rag_flow namespace and numpy -- both of which provide gadget chains capable of achieving code execution, rendering the safety mechanism insufficient.

Conceptual Proof of Vulnerability

  1. Attacker gains database write access (via SQL injection in VULN-001, credential leak, or similar)
  2. Injects a malicious pickle payload into any SerializedField column
  3. When RAGFlow reads that record, deserialize_b64() -> pickle.loads() -> RCE

Impact

This vulnerability is capable of Remote Code Execution on the RAGFlow server when chained with any database write vulnerability. The unsafe pickle deserialization affects all SerializedField ORM columns and executes with full RAGFlow server privileges. Additionally, the restricted mode provides false security -- the rag_flow namespace whitelist enables gadget chains to bypass restrictions.

Severity

High (7.5)

Attack vector: Network

Attack complexity: High

Privileges required: Low

User interaction: None

Scope: Unchanged

Confidentiality: High

Integrity: High

Availability: High

Open in visual CVSS calculator

Registry

Pypi

Affected Version

v0.24.0 and earlier

Visibility

Public

Status

Closed

Found by

iamveene
@iamveene

LIGHTWEIGHT