LightRAG WebUI EUVD-2026-84550

Requires LightRAG prior to 1.5.5 with the React WebUI in use. The attacker must be able to add/ingest a document whose content is returned through the query path (multi-user, shared-corpus, or untrusted-source ingestion deployments are most exposed). A victim user must then run a query that surfaces the poisoned content and view it in the WebUI, so exploitation depends on user interaction. The technical sinks are ChatMessage.tsx rendering answer and thinking content via react-markdown with rehypeRaw and skipHtml=false and no HTML sanitizer, plus the Mermaid securityLevel 'loose' path injecting generated SVG via innerHTML; payloads such as an iframe srcdoc or a crafted Mermaid block execute JavaScript in the WebUI origin. Limiting factors: victim must retrieve and view the content, the attacker needs ingestion capability, and instances that never ingest untrusted documents are effectively not exploitable.

This is a stored/DOM cross-site scripting flaw (CWE-79) in the LightRAG WebUI, scored 6.1 by the vendor (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network vector and low complexity are real, but two factors temper raw severity: it requires user interaction (a victim must retrieve and view the poisoned content) and it requires the attacker to first have the ability to ingest a document into the corpus, which is a genuine precondition even though the vendor marked PR:N. No EPSS score, KEV listing, or public POC was provided in the intelligence, so by the precision rules this is 'no public exploit identified at time of analysis' - not confirmed exploitation. The impact is bounded to C:L/I:L (theft of the API token in localStorage and performing API actions as the victim within the WebUI origin), with no availability impact. Net: a legitimate, patch-worthy web-app XSS but not an urgent internet-wide emergency - priority is driven by whether an instance accepts documents from untrusted or multi-tenant sources. Signals are internally consistent (advisory, PR, commit, and release all confirm the fix); the main gap is the absence of exploitation-probability data (EPSS/KEV/POC all unstated).

An attacker with the ability to add a document to a LightRAG instance stores raw HTML - for example an iframe with a malicious srcdoc, or a Mermaid code block leveraging the loose security level - inside content that the query path will return. When a legitimate user later runs a query that surfaces that content, MessageMarkdown renders it as active HTML (skipHtml=false, no sanitizer), executing attacker JavaScript in the WebUI origin to steal the API token from localStorage and perform API actions as the victim. No public exploit code was identified in the provided intelligence.