CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.

• CWE-79

• https://github.com/HKUDS/LightRAG/commit/8bf032a5200f293b482dd945d436e25cd08bd953
• https://github.com/HKUDS/LightRAG/pull/3437
• https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-xpjq-3w4w-w5wr

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-86054Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-86056Notepad++ is a free and open-source source code editor. Prio…5.5
• CVE-2026-86059Dokploy is a free, self-hostable Platform as a Service (PaaS…9.6
• CVE-2026-8606A Server-Side Request Forgery (SSRF) vulnerability was ident…5.9
• CVE-2026-86060RouterOS contains an argument-handling flaw in the SSH login…9.8
• CVE-2026-86064Klever-Go is the Go implementation of the Klever blockchain …8.6
• CVE-2026-86065Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-8607The Points Management System For Gamification, Ranks, Badges…6.4
• CVE-2026-86071Junrar is an open source Java RAR archive library. Prior to …3.7
• CVE-2026-86073n8n is an open source workflow automation platform. Prior to…7.6
• CVE-2026-86074n8n is an open source workflow automation platform. Prior to…7.1