Two flaws disclosed in LightRAG's API server and web interface

Two security advisories published on 22 September 2026 describe flaws in LightRAG, an open-source retrieval-augmented generation tool distributed as the Python package lightrag-hku. One advisory, tracked as CVE-2026-85709, covers sensitive information leaking through raw error messages from the API server. The other, CVE-2026-86062, covers stored cross-site scripting in the LightRAG WebUI, where JavaScript planted inside an ingested document runs in the browser of anyone who later retrieves it.

According to the first advisory, the LightRAG API server passes raw Python exception messages straight into HTTP error responses across more than 30 error handlers, in every router file. The report counts roughly 33 locations where an exception is caught and its text returned verbatim, including 13 in the document routes and 12 in the graph routes. No global handler sanitises the messages first. The advisory says the only pre-existing custom exception handler covers a specific validation error on one endpoint and does not apply to the generic handlers in route code.

The advisory lists what can leak: server filesystem paths from the default JSON storage backend, the host, port, user and database name that a database driver was trying to reach, error details from LLM providers such as model names and organisation ids, and Python library internals that fingerprint the server stack. In a proof of concept, making a storage file unreadable caused the server to return the full server-side path in a JSON response. The report notes the PostgreSQL backend's driver does not echo passwords, but backends configured by URI, such as MongoDB, can surface a connection string that embeds credentials. The risk is amplified by LightRAG's default unauthenticated configuration, the advisory says, which is covered in a companion report and means any network-reachable client can trigger and read the errors without credentials.

The second advisory concerns the chat renderer in the WebUI. It says the component that displays assistant answers is configured to render raw HTML, using the rehype-raw plugin with HTML skipping switched off, and with no sanitiser, element allow-list or URL transform. Because answers are built from user-ingested documents, an attacker who can add a single document can store a payload that executes later. The report says react-markdown's built-in defences do not help here: URL sanitising blocks javascript: links and React drops string event handlers, but elements such as an iframe with a srcdoc attribute are rendered unchanged and execute.

The researcher ran a local proof of concept reproducing the exact renderer configuration at commit f3378a3, version 1.5.5, and reported that an injected script ran in headless Chromium and Edge. A second script-execution path is described through mermaid diagrams, which the WebUI initialises with its security level set to "loose", disabling mermaid's own output sanitisation. The advisory also flags that the maths renderer is set to trust input, allowing an arbitrary remote image load, and recommends turning that off.

The impact, according to the advisory, is that LightRAG stores its authentication token in browser localStorage, so injected JavaScript can read the token and drive the API as the victim, including modifying or deleting the knowledge base and graph. Both reports are listed as reported, with suggested remediation including replacing the raw exception passthrough pattern.