CVE-2026-86062
Deferred Deferred - Pending Action

XSS in LightRAG WebUI via Unsanitized Markdown Rendering

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-86062
EUVD
EUVD-2026-84550

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hkuds lightrag to 1.5.4 (inc)
hkuds lightrag 1.5.5
lightrag lightrag_webui 1.5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LightRAG versions before 1.5.5 are vulnerable to stored cross-site scripting (XSS) due to improper HTML sanitization. Attackers can inject malicious HTML or JavaScript into documents, which is later rendered in the WebUI without proper sanitization. This allows execution of attacker-controlled scripts in the victim's browser.

Detection Guidance

Detecting this vulnerability requires checking if your LightRAG WebUI version is below 1.5.5. Run: npm list lightrag_webui to check the installed version. If it is below 1.5.5, the system is vulnerable.

Impact Analysis

An attacker could steal sensitive data like API tokens from your browser's localStorage. They could also perform unauthorized actions on your behalf by leveraging the stolen token. This could lead to data breaches or unauthorized access to your LightRAG instance.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade LightRAG WebUI to version 1.5.5 or later immediately. After upgrading, review any stored documents for malicious HTML or JavaScript content. Remove or sanitize any suspicious content to prevent further exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart