lightrag-hku vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-86062Mediumlightrag-hku: lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content CVE-2026-85740Highlightrag-hku: lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard CVE-2026-85734Criticallightrag-hku: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks CVE-2026-85725Mediumlightrag-hku: lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function CVE-2026-85709Mediumlightrag-hku: lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses CVE-2026-61740Criticallightrag-hku: LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection CVE-2026-61736Criticallightrag-hku: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests CVE-2026-39413Mediumlightrag-hku: lightrag-hku: JWT Algorithm Confusion Vulnerability CVE-2026-30762Highlightrag-hku: LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass CVE-2025-6773Mediumlightrag-hku: HKUDS LightRAG allows Path Traversal via function upload_to_input_dir

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo