# RAGFlow: Unsafe pickle.loads() in deserialize_b64() Disabled by Default Safety Mechanism in [infiniflow/ragflow](https://github.com/infiniflow/ragflow)

closed

Reported on Mar 8th 2026

---

# Description

RAGFlow's `deserialize_b64()` function calls Python's unrestricted `pickle.loads()` by default. The safety mechanism (`RestrictedUnpickler`) is gated behind a configuration flag `use_deserialize_safe_module` that defaults to `False`. This function is called from the ORM layer whenever a `SerializedField` (which defaults to PICKLE type) is read from the database. An attacker who can inject a crafted pickle payload into any serialized database column achieves RCE on the RAGFlow server.

## Affected Code

**File:**`api/utils/configs.py:53-61`

```python
def deserialize_b64(src):
    src = base64.b64decode(src)
    use_deserialize_safe_module = get_base_config('use_deserialize_safe_module', False)
    if use_deserialize_safe_module:
        return restricted_loads(src)
    return pickle.loads(src)  # UNRESTRICTED by default
```

**File:**`api/db/db_models.py:99` -- `SerializedField` defaults to PICKLE type, meaning all SerializedField columns in the ORM use this unsafe deserialization path.

## Secondary Issue

Even when `use_deserialize_safe_module=True`, the `RestrictedUnpickler` whitelists the entire `rag_flow` namespace and `numpy` -- both of which provide gadget chains capable of achieving code execution, rendering the safety mechanism insufficient.

## Conceptual Proof of Vulnerability

1. Attacker gains database write access (via SQL injection in VULN-001, credential leak, or similar)
2. Injects a malicious pickle payload into any SerializedField column
3. When RAGFlow reads that record, `deserialize_b64()` -> `pickle.loads()` -> RCE

# Impact

This vulnerability is capable of Remote Code Execution on the RAGFlow server when chained with any database write vulnerability. The unsafe pickle deserialization affects all SerializedField ORM columns and executes with full RAGFlow server privileges. Additionally, the restricted mode provides false security -- the rag_flow namespace whitelist enables gadget chains to bypass restrictions.

Severity

High (7.5)

Attack vector: Network

Attack complexity: High

Privileges required: Low

User interaction: None

Scope: Unchanged

Confidentiality: High

Integrity: High

Availability: High

[Open in visual CVSS calculator](https://cvss.js.org/#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)

Registry

Pypi

Affected Version

v0.24.0 and earlier

Visibility

Public

Status

Closed

Found by

[iamveene](/content/users/iamveene/index.html)  
@iamveene

LIGHTWEIGHT