lightrag-hku vulnerabilities (PyPI)
10 vulnerabilities.
-
lightrag-hkuPyPI LightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content 6.1 Medium -
lightrag-hkuPyPI LightRAG: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard 7.1 High -
lightrag-hkuPyPI LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks 9.1 Critical -
lightrag-hkuPyPI LightRAG: Plaintext Passwords Compared Without Constant-Time Function 5.9 Medium -
lightrag-hkuPyPI LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses 5.3 Medium -
lightrag-hkuPyPI LightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection 9.3 Critical -
lightrag-hkuPyPI LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests 9.3 Critical -
lightrag-hkuPyPI LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API 4.2 Medium -
lightrag-hkuPyPI LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass 7.5 High -
lightrag-hkuPyPI HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversal 4.8 Medium