CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...