context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85734 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85734 Source advisory: GHSA-FRCH-4W6V-Q5XX...

lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightragserver.py:2161 @app.post"/login" async def loginformdata: OAuth2PasswordRequestForm =...

GHSA-FRCH-4W6V-Q5XX lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Summary The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed. Details python lightrag/api/lightragserver.py:2161 @app.post"/login" async def loginformdata: OAuth2PasswordRequestForm =...

context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85725 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85725 Source advisory: GHSA-C759-CX9P-MRWQ...

context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85725 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85725 Source advisory: SNYK:PYTHON-LIGHTRAGHKU-21693624...

Timing Attack

Overview lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Timing Attack via the verifypassword function in lightrag/api/passwords.py, which compares plaintext AUTHACCOUNTS passwords using Python's == operator. This...

GHSA-C759-CX9P-MRWQ lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Summary When plaintext passwords are stored in AUTHACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. Details python lightrag/api/passwords.py:13-26 def...

context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85725 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85725 Source advisory: OSV:GHSA-C759-CX9P-MRWQ...

lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Summary When plaintext passwords are stored in AUTHACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character. Details python lightrag/api/passwords.py:13-26 def...

GHSA-HRMJ-7RVJ-4HG8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85709 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85709 Source advisory: SNYK:PYTHON-LIGHTRAGHKU-21693627...

context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85709 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85709 Source advisory: OSV:GHSA-HRMJ-7RVJ-4HG8...

Information Exposure

Overview lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Information Exposure via bare raw-exception passthrough in the resolvetextchunking validation within documentroutes.py, where unhandled ValueError exceptions...

context-graph-spaces (>=0.1.0, <=0.1.2), lightrag-memgraph (>=0.1.0, <=0.3.2) +5 more potentially affected by CVE-2026-85709 via lightrag-hku (>=1.4.7, <=1.5.4)

lightrag-hku PYPI version =1.4.7, =0.1.0, =0.1.0, =1.4.0, =0.1.0, =0.7.1 Source cves: CVE-2026-85709 Source advisory: GHSA-HRMJ-7RVJ-4HG8...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

CVE-2026-85709

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in documentroutes.py, graphroutes.py, queryroutes.py, ollamaapi.py, and lightragserver.py. The detail=stre, detail=strexc, and equivalent...

CVE-2026-85734

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

CVE-2026-85740

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, validatedaddresses in lightrag/parser/markdown/parser.py evaluates the literal resolved address with ipaddress.isglobal without consistently classifying an IPv4 address embedded in an IPv6 transition wrapper. A call...

CVE-2026-86062

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightragwebui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store r...

CVE-2026-85725

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verifypassword in lightrag/api/passwords.py compares plaintext AUTHACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences...