Wangyihang

**Name of the Vulnerable Software and Affected Versions** RAGFlow versions prior to 0.24.0 **Description** An issue exists in the Agent workflow Text Processing (StringTransform) and Message components. These components utilize an unsandboxed Python `jinja2.Template` to render templates provided by users. This allows an authenticated user to perform Server-Side Template Injection (SSTI), a technique where an attacker injects malicious code into a template that is then executed on the server, leading to the execution of arbitrary operating system commands. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict the use of the Text Processing (StringTransform) and Message components within the Agent workflow to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Atheos versions prior to v600 **Description** Atheos is a self-hosted browser-based cloud IDE. The issue is related to the lack of proper validation of the `$path` and `$target` parameters across multiple components, allowing an attacker to read, modify, or execute arbitrary files on the server. This can be exploited through various attack vectors present in multiple PHP files. **Recommendations** For versions prior to v600, update to v600 to fix the issue. As a temporary workaround, consider restricting access to the vulnerable parameters `$path` and `$target` to minimize the risk of exploitation.