CVE-2024-12433
CVSS 3.0 Score 9.8 of 10 (critical)
Details
Published Mar 20, 2025
CWE ID 502
Summary
CVE-2024-12433 is a remote code execution vulnerability affecting infiniflow/ragflow versions up to 0.12.0. The issue stems from the RPC server in RagFlow using a hard-coded AuthKey, which can be easily obtained by attackers to join group communications without restrictions. Furthermore, the server employs pickle deserialization via `pickle.loads()` on `connection.recv()`, making it susceptible to remote code execution. This vulnerability has been addressed in version 0.14.0.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.