# lightrag-hku (PyPI) vulnerabilities 9 known vulnerabilities (3 critical, 1 high, 5 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.5.7 (Sep 2, 2026): no advisory affects it - Newest unaffected release: 1.5.7 (Sep 2, 2026), the latest release - Weekly downloads: 35.6K - Dependents: 34 - Releases: 94 since 0.0.2 (Oct 10, 2024) - Registry: https://pypi.org/project/lightrag-hku/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-86062: 0.0.2 to 1.5.5rc1 (1.5.5 is outside it) - CVE-2026-85740: 0.0.2 to 1.5.5rc1 (1.5.5 is outside it) - CVE-2026-85734: 0.0.2 to 1.5.5rc1 (1.5.5 is outside it) - CVE-2026-85725: 0.0.2 to 1.5.5rc1 (1.5.5 is outside it) - CVE-2026-85709: 0.0.2 to 1.5.5rc1 (1.5.5 is outside it) - CVE-2026-61740: 0.0.2 to 1.5.3 (1.5.4 is outside it) - CVE-2026-61736: 0.0.2 to 1.5.3 (1.5.4 is outside it) - CVE-2026-39413: 0.0.2 to 1.4.13 (1.4.14 is outside it) - CVE-2025-6773: 0.0.2 to 1.3.7 (1.3.8 is outside it) ## Advisories (9) ### [CVE-2026-86062](https://cve.now/CVE-2026-86062): LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content - Severity: Medium 6.1 - Published: Sep 22, 2026 - Affected: fixed in 1.5.5. - Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-85740](https://cve.now/CVE-2026-85740): LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard - Severity: High 7.1 - Published: Sep 22, 2026 - Affected: fixed in 1.5.5. - Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-85734](https://cve.now/CVE-2026-85734): LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks - Severity: Critical 9.1 - Published: Sep 22, 2026 - Affected: fixed in 1.5.5. - Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-85725](https://cve.now/CVE-2026-85725): LightRAG: Plaintext Passwords Compared Without Constant-Time Function - Severity: Medium 5.9 - Published: Sep 22, 2026 - Affected: fixed in 1.5.5. - Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-85709](https://cve.now/CVE-2026-85709): LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses - Severity: Medium 5.3 - Published: Sep 22, 2026 - Affected: fixed in 1.5.5. - Fixed in 1.5.5 (released Jul 31, 2026, 53 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-61740](https://cve.now/CVE-2026-61740): LightRAG: Authentication bypass: hardcoded DEFAULT\_TOKEN\_SECRET and public /auth-status defeat LIGHTRAG\_API\_KEY protection - Severity: Critical 9.3 - Published: Jul 15, 2026 - Affected: fixed in 1.5.4. - Fixed in 1.5.4 (released Jun 24, 2026, 21 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-61736](https://cve.now/CVE-2026-61736): LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests - Severity: Critical 9.3 - Published: Jul 15, 2026 - Affected: fixed in 1.5.4. - Fixed in 1.5.4 (released Jun 24, 2026, 21 days before disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2026-39413](https://cve.now/CVE-2026-39413): LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API - Severity: Medium 4.2 - Published: Apr 8, 2026 - Affected: fixed in 1.4.14. - Fixed in 1.4.14 (released Apr 12, 2026, 4 days after disclosure). - The latest release, 1.5.7, is not affected. ### [CVE-2025-6773](https://cve.now/CVE-2025-6773): HKUDS LightRAG File Upload document\_routes.py upload\_to\_input\_dir path traversal - Severity: Medium 4.8 - Published: Jun 27, 2025 - Affected: fixed in 1.3.8. - Fixed in 1.3.8 (released Jun 5, 2025, 22 days before disclosure). - The latest release, 1.5.7, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/lightrag-hku Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.