Executive brief
LightRAG WebUI is a web interface for a knowledge-graph AI system that ingests documents and generates AI-assisted answers. The vulnerability allows an attacker to store malicious HTML/JavaScript in documents; when any user (typically an administrator) retrieves answers containing that document, the injected script executes in their browser and can steal authentication tokens from local storage, leading to full account and instance takeover.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in ChatMessage.tsx, where react-markdown is configured with rehypePlugins={[rehypeRaw]} and skipHtml={false} but lacks the rehype-sanitize plugin, element allow-lists, or URL transformation. This permits raw HTML elements such as <iframe srcdoc="…"> and <svg><script> to render and execute unchanged. The attack vector is document ingestion: an unauthenticated user (in default config) or low-privilege collaborator can POST a document via /documents/text or /documents/upload containing embedded JavaScript; when the document is later retrieved via /query, the payload is streamed into assistantMessage.content and rendered by the vulnerable sink. A secondary vector exists via mermaid diagrams initialized with securityLevel: 'loose', which also permits script injection. The injected script can read the LIGHTRAG-API-TOKEN from localStorage and exfiltrate it or make arbitrary API calls on behalf of the victim.
Affected products
- lightrag-hku LightRAG up to v1.5.5
Timeline
- 2026-09-22: disclosed
- 2026-09-22: advisory: GHSA-xpjq-3w4w-w5wr published