CVE-2025-27135 is a Critical (CVSS 9.8) SQL injection in the ExeSQL component of RAGFlow 0.15.1 and earlier. At publication no patched version was available. Check the project's releases for a fix and limit access to agents that use ExeSQL. Disable the component where you do not need it.
What's affected
Affected: RAGFlow versions 0.15.1 and prior. The GitHub advisory GHSA-3gqj-66qm-25jq lists patched versions as none, and the record says no patched version was available at the time of publication.
That statement is from early 2025. Later releases may include a fix or a change to the component, and I did not confirm one, so read the project's release notes and the advisory for the current state before you rely on an upgrade.
RAGFlow is an open source retrieval augmented generation engine. The affected piece, ExeSQL, is an agent component that takes a SQL statement from its input and runs it against a database.
How to check if you're exposed
Find which version your deployment runs. For Docker based installs, look at the image tag:
docker ps --format "table {{.Names}}\t{{.Image}}" | grep -i ragflow
If you built from source, check the tag or commit:
git describe --tags 2>/dev/null
Then find out whether any of your agent workflows use the ExeSQL component, and which database credentials they hold. If no workflow uses it, your exposure is smaller. If one does, check what the database account is allowed to do.
The free in-browser scan can list known advisories for dependency manifests, and the demo below shows how to ask whether a flaw is reachable in your setup.
What to do now
- Identify every RAGFlow instance and its version.
- Read the project's releases and the advisory for any fix after 0.15.1, and upgrade if one exists for your branch.
- List the agent workflows that use ExeSQL and disable them if they are not needed.
- Give the database account used by ExeSQL read only rights on only the tables it needs.
- Limit who can create or edit agent workflows, and who can send input to them.
- Do not expose the RAGFlow interface to the internet without authentication and network limits.
Why it matters
The record lists CWE-89. The ExeSQL component takes the SQL statement from its input and sends it directly to the database query. The record says the statement is not checked first, so whoever controls the input controls the query.
In a tool that is designed to run SQL, the line between feature and flaw is thin: the component runs text as SQL by design. The danger is who can supply that text. When agents take input from chat users, documents or other systems, the database can be reached by people who should not have that power. The fix is partly code and partly policy: read only accounts, narrow permissions and strong access control. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Applications built around language models add new routes by which untrusted text reaches sensitive systems. Treat each tool or component an agent can call as an interface that needs the same input checks as any web form.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version?
At publication, no. The advisory lists none. Check the project's current releases and advisory for updates, since this has probably changed.
Can I reduce risk without a patch?
Yes. Remove or disable ExeSQL where not needed, use a read only database account with minimal tables, and restrict who can reach the service.
Sources
Last reviewed: 19 October 2026.
