rag

2 pieces of writing

RAGFlow PR #14803 removed a CWE-502 pickle RCE footgun from deserialize_b64

vulnerability7 min read

RAGFlow PR #14803 removed a CWE-502 pickle RCE footgun from deserialize_b64

RAGFlow's deserialize_b64 helper defaulted to bare pickle.loads behind an unset safety flag. PR #14803 makes RestrictedUnpickler the only path.

LightRAG's Memgraph backend had a Cypher injection vulnerability hiding in plain sight

vulnerability7 min read

LightRAG's Memgraph backend had a Cypher injection vulnerability hiding in plain sight