GHSA-xpjq-3w4w-w5wr: lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

Summary

The LightRAG WebUI renders assistant answer content as raw HTML, using react-markdown with rehypeRaw, skipHtml set to false, and no sanitizer or allow-list. Because answers are derived from ingested documents, an attacker who can add one document can store a payload that runs in the browser of any user who later retrieves it, such as an administrator. The source says this can lead to authentication token theft from localStorage and full API takeover, and no authentication is required in the default configuration.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News