Security
فارسی
All products

lightrag-hku

PyPI · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesCVE-2026-85709 · GHSA-HRMJ-7RVJ-4HG8Version ranges need review. lightrag-hku PyPI Medium Fix reported
lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guardCVE-2026-85740 · GHSA-VV3M-F8X4-7377Version ranges need review. lightrag-hku PyPI High Fix reported
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksCVE-2026-85734 · GHSA-FRCH-4W6V-Q5XXVersion ranges need review. lightrag-hku PyPI Critical Fix reported
lightrag-hku: Plaintext Passwords Compared Without Constant-Time FunctionCVE-2026-85725 · GHSA-C759-CX9P-MRWQVersion ranges need review. lightrag-hku PyPI Medium Fix reported
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentCVE-2026-86062 · GHSA-XPJQ-3W4W-W5WRVersion ranges need review. lightrag-hku PyPI Medium Fix reported
LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionCVE-2026-61740 · GHSA-F4VV-55C2-5789Version ranges need review. lightrag-hku PyPI Critical Fix reported
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsCVE-2026-61736 · GHSA-6X6H-QQR7-855WVersion ranges need review. lightrag-hku PyPI Critical Fix reported
LightRAG: Hardcoded JWT Signing Secret Allows Authentication BypassCVE-2026-30762 · GHSA-MCWW-4HXQ-HFR3Version ranges need review. lightrag-hku PyPI High Fix reported
lightrag-hku: JWT Algorithm Confusion Vulnerability CVE-2026-39413 · GHSA-8FFJ-4HX4-9PGFVersion ranges need review. lightrag-hku PyPI Medium Fix reported
HKUDS LightRAG allows Path Traversal via function upload_to_input_dirCVE-2025-6773 · GHSA-V9W6-9HQ9-33CHVersion ranges need review. lightrag-hku PyPI Medium Fix reported