lightrag-hku
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 20 advisory(ies) without a verdict
Advisories (20)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-6x6h-qqr7-855w LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests | < 1.5.4 | Undetermined |
| GHSA-8ffj-4hx4-9pgf lightrag-hku: JWT Algorithm Confusion Vulnerability | < 1.4.14 | Undetermined |
| GHSA-c759-cx9p-mrwq lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function | < 1.5.5 | Undetermined |
| GHSA-f4vv-55c2-5789 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection | < 1.5.4 | Undetermined |
| GHSA-frch-4w6v-q5xx lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks | < 1.5.5 | Undetermined |
| GHSA-hrmj-7rvj-4hg8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses | < 1.5.5 | Undetermined |
| GHSA-mcww-4hxq-hfr3 LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass | < 1.4.13 | Undetermined |
| GHSA-v9w6-9hq9-33ch HKUDS LightRAG allows Path Traversal via function upload_to_input_dir | < 1.3.8 | Undetermined |
| GHSA-vv3m-f8x4-7377 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard | < 1.5.5 | Undetermined |
| GHSA-xpjq-3w4w-w5wr lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content | < 1.5.5 | Undetermined |
| PYSEC-2026-1539 HKUDS LightRAG allows Path Traversal via function upload_to_input_dir | < 1.3.8 | Undetermined |
| PYSEC-2026-2592 lightrag-hku: JWT Algorithm Confusion Vulnerability | < 1.4.14 | Undetermined |
| PYSEC-2026-2593 LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass | < 1.4.13 | Undetermined |
| PYSEC-2026-3474 LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests | < 1.5.4 | Undetermined |
| PYSEC-2026-3475 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection | < 1.5.4 | Undetermined |
| PYSEC-2026-4061 lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function | < 1.5.5 | Undetermined |
| PYSEC-2026-4062 lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks | < 1.5.5 | Undetermined |
| PYSEC-2026-4063 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses | < 1.5.5 | Undetermined |
| PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard | < 1.5.5 | Undetermined |
| PYSEC-2026-4065 lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content | < 1.5.5 | Undetermined |
Sources
| Source | Licence |
|---|