CVE-2025-51462

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-51462

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51462.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-51462

Published

2025-07-22T00:00:00Z

Modified

2026-08-12T03:51:27.056930678Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialogapp.setdialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/51xxx/CVE-2025-51462.json"
}

References

Affected packages

Git / github.com/infiniflow/ragflow

Affected ranges

Type

GIT

Repo

https://github.com/infiniflow/ragflow

Events

Introduced

baf3b9be7c759ca54b6ee8778411c86e7263ee7f

Last affected

baf3b9be7c759ca54b6ee8778411c86e7263ee7f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.17.2"
        },
        {
            "last_affected": "0.17.2"
        }
    ],
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:infiniflow:ragflow:0.17.2:*:*:*:*:*:*:*"
}

Affected versions

0.*

0.17.2

v0.*

v0.17.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51462.json"