LightRAG API sensitive information exposure and XSS vulnerabilities

LightRAG's API server exposes sensitive infrastructure details through raw exception messages in error responses, and the WebUI is vulnerable to stored XSS via unsanitized HTML rendering of ingested document content.

Disclosed 22 September 2026 · Record updated 1 October 2026

Impact

Unauthenticated attackers can trigger exceptions to leak database credentials, filesystem paths, and infrastructure details; authenticated attackers can inject malicious HTML/JavaScript into documents that executes in users' browsers and steals authentication tokens.

Our coverage

A transparent glass tower crumbles as invisible hands pull blueprints from its broken windows while poisoned scrolls unfurl, spreading corrupted symbols across the floor below.

Vulnerabilities

Two flaws disclosed in LightRAG's API server and web interface

Advisories published on 22 September 2026 say the retrieval tool leaks infrastructure details in error messages and runs attacker HTML from ingested documents.

22 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-hrmj-7rvj-4hg8
github.comhttps://github.com/advisories/GHSA-xpjq-3w4w-w5wr