CVE-2026-86062 in LightRAG
Summary
by MITRE • 09/22/2026
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in LightRAG versions prior to 1.5.5 represents a critical stored cross-site scripting (XSS) flaw rooted in improper input validation and unsafe rendering practices within the web user interface component responsible for displaying chat messages. The core technical deficiency lies in the configuration of the Markdown parsing libraries, specifically react-markdown combined with rehypeRaw, where the skipHtml option is set to false without an accompanying HTML sanitizer. This configuration allows raw HTML tags embedded within stored documents to pass through the rendering pipeline unchanged. When a user retrieves and queries these documents, the system processes them through MessageMarkdown, which interprets the injected HTML as active content rather than static text. Consequently, any malicious script or interactive element contained within the document is executed in the context of the LightRAG WebUI origin upon display to subsequent users who access that specific query result.
The operational impact of this vulnerability is severe due to its stored nature and the high-privilege context in which it executes. An attacker with the ability to upload or add documents can persistently store malicious payloads, such as iframe elements utilizing srcdoc attributes containing JavaScript code. Furthermore, the rendering path for Mermaid diagrams introduces an additional attack vector by injecting generated SVG content via innerHTML operations under a loose security level setting. This combination ensures that even complex visualizations can serve as carriers for executable scripts. Because these scripts run within the origin of the LightRAG application, they inherit full access to browser storage mechanisms and session cookies. Specifically, attackers can read sensitive API tokens stored in localStorage, effectively hijacking user sessions or impersonating legitimate users to perform unauthorized actions against the underlying AI infrastructure.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored XSS where malicious content is saved on target servers. The exploitation technique maps directly to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code within the browser environment, and potentially T1534 Internal Spearphishing if used to trick users into clicking links that trigger retrieval of poisoned documents. The ability to access localStorage also relates to CWE-284 Improper Access Control which allows unauthorized data exposure.
Mitigation strategies must focus on implementing strict output encoding and content security policies alongside the software update. While upgrading to version 1.5.5 resolves the immediate issue by addressing the rendering configuration, defensive measures should include enforcing a Content Security Policy that restricts inline script execution and limits sources for external resources. Additionally, developers should employ robust HTML sanitization libraries such as DOMPurify before passing any user-supplied content through Markdown renderers to ensure that only safe tags are permitted. Input validation at the document upload stage can further reduce risk by rejecting files containing executable code or suspicious markup patterns. Regular security audits of third-party library configurations, particularly those involving rich text rendering and SVG generation, are essential to prevent similar vulnerabilities in future iterations.