CVE-2024-12433
A vulnerability in infiniflow/ragflow versions v0.12.0 allows for remote code execution. The RPC server in RagFlow uses a hard-coded AuthKey 'authkey=b'infiniflow-token4kevinhu'' which can be easily fetched by attackers to join the group communication without restrictions. Additionally, the server processes incoming data using pickle deserialization via `pickle.loads()` on `connection.recv()`, making it vulnerable to remote code execution. This issue is fixed in version 0.14.0.
- Affected products
- Ragflow
- Infiniflow Ragflow
- < 0.14.0
- Fix
- Available
- CVSS 3.0
- 9.8 CRITICAL
- EPSS
- 1.5% (73th percentile)
- Weakness
- CWE-502
- NVD status
- Analyzed
- Published
- 2025-03-20
CVE-2024-12433 at NVD
No indexed exploits for CVE-2024-12433 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-12433 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.