lightrag-hku
Page établie d’après les avis qui citent ce paquet : ses métadonnées de registre (versions, licence, dépendances) n’ont pas encore été récupérées par ce service.
En bref
- Écosystème
- PyPI
- État de vulnérabilité
- 20 avis sans verdict
Avis (20)
| Avis | Versions affectées | Dernière version |
|---|---|---|
| GHSA-6x6h-qqr7-855w LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests | < 1.5.4 | Indéterminé |
| GHSA-8ffj-4hx4-9pgf lightrag-hku: JWT Algorithm Confusion Vulnerability | < 1.4.14 | Indéterminé |
| GHSA-c759-cx9p-mrwq lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function | < 1.5.5 | Indéterminé |
| GHSA-f4vv-55c2-5789 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection | < 1.5.4 | Indéterminé |
| GHSA-frch-4w6v-q5xx lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks | < 1.5.5 | Indéterminé |
| GHSA-hrmj-7rvj-4hg8 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses | < 1.5.5 | Indéterminé |
| GHSA-mcww-4hxq-hfr3 LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass | < 1.4.13 | Indéterminé |
| GHSA-v9w6-9hq9-33ch HKUDS LightRAG allows Path Traversal via function upload_to_input_dir | < 1.3.8 | Indéterminé |
| GHSA-vv3m-f8x4-7377 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard | < 1.5.5 | Indéterminé |
| GHSA-xpjq-3w4w-w5wr lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content | < 1.5.5 | Indéterminé |
| PYSEC-2026-1539 HKUDS LightRAG allows Path Traversal via function upload_to_input_dir | < 1.3.8 | Indéterminé |
| PYSEC-2026-2592 lightrag-hku: JWT Algorithm Confusion Vulnerability | < 1.4.14 | Indéterminé |
| PYSEC-2026-2593 LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass | < 1.4.13 | Indéterminé |
| PYSEC-2026-3474 LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests | < 1.5.4 | Indéterminé |
| PYSEC-2026-3475 LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection | < 1.5.4 | Indéterminé |
| PYSEC-2026-4061 lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function | < 1.5.5 | Indéterminé |
| PYSEC-2026-4062 lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks | < 1.5.5 | Indéterminé |
| PYSEC-2026-4063 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses | < 1.5.5 | Indéterminé |
| PYSEC-2026-4064 lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guard | < 1.5.5 | Indéterminé |
| PYSEC-2026-4065 lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content | < 1.5.5 | Indéterminé |
Sources
| Source | Licence |
|---|