CVE-2026-86062: LightRAG WebUI stored XSS in chat answer renderer

CVE-2026-86062 · Severity: medium · CVSS 6.1 · Published 2026-09-22

LightRAG WebUI is a web interface for a knowledge-graph AI system that ingests documents and generates AI-assisted answers. The vulnerability allows an attacker to store malicious HTML/JavaScript in documents; when any user (typically an administrator) retrieves answers containing that document, the injected script executes in their browser and can steal authentication tokens from local storage, leading to full account and instance takeover.

Technologies: lightrag-hku (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-86062 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86062 being exploited in the wild.
How severe is CVE-2026-86062?
Medium severity, with a CVSS score of 6.1, published 22 September 2026.
Which products and versions are affected?
lightrag-hku (PyPI) <= 1.5.4, ECOSYSTEM:introduced=0,fixed=1.5.5.
Is there a fix for CVE-2026-86062?
Yes. lightrag-hku (PyPI): upgrade to 1.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86062 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86062?
Check whether you run lightrag-hku (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lightrag-hku (PyPI): upgrade to 1.5.5 or later
    pip install "lightrag-hku>=1.5.5"

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in ChatMessage.tsx, where react-markdown is configured with rehypePlugins={[rehypeRaw]} and skipHtml={false} but lacks the rehype-sanitize plugin, element allow-lists, or URL transformation. This permits raw HTML elements such as &lt;iframe srcdoc="…"&gt; and &lt;svg&gt;&lt;script&gt; to render and execute unchanged. The attack vector is document ingestion: an unauthenticated user (in default config) or low-privilege collaborator can POST a document via /documents/text or /documents/upload containing embedded JavaScript; when the document is later retrieved via /query, the payload is streamed into assistantMessage.content and rendered by the vulnerable sink. A secondary vector exists via mermaid diagrams initialized with securityLevel: 'loose', which also permits script injection. The injected script can read the LIGHTRAG-API-TOKEN from localStorage and exfiltrate it or make arbitrary API calls on behalf of the victim.

Affected products

  • lightrag-hku LightRAG up to v1.5.5

Identifiers

  • CVE-2026-86062
  • GHSA-xpjq-3w4w-w5wr
  • PYSEC-2026-4065

Timeline

  • 2026-09-22: disclosed
  • 2026-09-22: advisory: GHSA-xpjq-3w4w-w5wr published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.