PyPIPackage

lightrag-hku

9 known vulnerabilities (3 critical, 1 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release: 1.5.7 (Sep 2, 2026): no advisory affects it
Newest unaffected release: 1.5.7 (Sep 2, 2026), the latest release
Advisories: 9 · 3 critical, 1 high, 5 medium

Weekly downloads: 35.6K
Dependents: 34
Releases: 94 since 0.0.2 (Oct 10, 2024)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-86062
Affects 0.0.2 to 1.5.5rc1 (1.5.5 is outside it)
CVE-2026-85740
Affects 0.0.2 to 1.5.5rc1 (1.5.5 is outside it)
CVE-2026-85734
Affects 0.0.2 to 1.5.5rc1 (1.5.5 is outside it)
CVE-2026-85725
Affects 0.0.2 to 1.5.5rc1 (1.5.5 is outside it)
CVE-2026-85709
Affects 0.0.2 to 1.5.5rc1 (1.5.5 is outside it)
CVE-2026-61740
Affects 0.0.2 to 1.5.3 (1.5.4 is outside it)
CVE-2026-61736
Affects 0.0.2 to 1.5.3 (1.5.4 is outside it)
CVE-2026-39413
Affects 0.0.2 to 1.4.13 (1.4.14 is outside it)
CVE-2025-6773
Affects 0.0.2 to 1.3.7 (1.3.8 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-86062Medium 6.1
LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
Affected: fixed in 1.5.5.
Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-85740High 7.1
LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard
Affected: fixed in 1.5.5.
Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-85734Critical 9.1
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
Affected: fixed in 1.5.5.
Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-85725Medium 5.9
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
Affected: fixed in 1.5.5.
Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-85709Medium 5.3
LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses
Affected: fixed in 1.5.5.
Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-61740Critical 9.3
LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
Affected: fixed in 1.5.4.
Fixed in 1.5.4 (released Jun 24, 2026, 21 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-61736Critical 9.3
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Affected: fixed in 1.5.4.
Fixed in 1.5.4 (released Jun 24, 2026, 21 days before disclosure).
The latest release, 1.5.7, is not affected.
CVE-2026-39413Medium 4.2
LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
Affected: fixed in 1.4.14.
Fixed in 1.4.14 (released Apr 12, 2026, 4 days after disclosure).
The latest release, 1.5.7, is not affected.
CVE-2025-6773Medium 4.8
HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal
Affected: fixed in 1.3.8.
Fixed in 1.3.8 (released Jun 5, 2025, 22 days before disclosure).
The latest release, 1.5.7, is not affected.