lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content

Summary The LightRAG WebUI renders assistant/answer chat content as raw HTML — react-markdown is configured with rehypePlugins=rehypeRaw and skipHtml=false and no HTML sanitizer rehype-sanitize, element allow-list, or custom urlTransform. Because answer content is derived from user-ingested...