CVE-2026-86062: LightRAG WebUI XSS Vulnerability

CVE-2026-86062 Overview

CVE-2026-86062 is a stored cross-site scripting (XSS) vulnerability in LightRAG, an open-source retrieval-augmented generation (RAG) framework maintained by HKUDS. Versions prior to 1.5.5 render chat answer and thinking content in lightrag_webui/src/components/retrieval/ChatMessage.tsx using react-markdown with rehypeRaw and skipHtml=false, and without an HTML sanitizer. An attacker who can add a document can store raw HTML that is later returned through the query path and executed in the WebUI origin. The flaw is tracked as CWE-79 and is fixed in LightRAG 1.5.5.

Critical Impact
Attacker-controlled JavaScript executes in the LightRAG WebUI origin, allowing theft of the API token stored in localStorage and API actions performed as the victim user.

Affected Products

LightRAG WebUI versions prior to 1.5.5
lightrag_webui/src/components/retrieval/ChatMessage.tsx Markdown rendering path
Mermaid diagram rendering path using securityLevel: loose

Discovery Timeline

2026-09-22 - CVE-2026-86062 published to NVD
2026-09-22 - Last updated in NVD database
v1.5.5 - HKUDS releases fixed version of LightRAG

Technical Details for CVE-2026-86062

Vulnerability Analysis

The LightRAG WebUI renders assistant responses as Markdown using react-markdown. The pipeline is configured with rehypeRaw and skipHtml=false, which explicitly permits raw HTML embedded inside Markdown to pass through to the React virtual DOM. No sanitizer such as rehype-sanitize is applied before rendering.

Any content ingested through the document-add path that is later surfaced through the query response is treated as trusted Markdown. Because the corpus is user-controlled, an attacker who can upload or add a document controls a portion of the output that MessageMarkdown will render as active HTML.

A second execution sink exists in the Mermaid rendering path. Mermaid is initialized with securityLevel: loose, and its generated SVG is written into the DOM through innerHTML, which does not neutralize event handlers or script-bearing attributes produced from crafted diagrams.

Root Cause

The root cause is missing output sanitization in the Markdown-to-HTML pipeline. rehypeRaw converts raw HTML nodes in the Markdown AST into real HTML elements, and no downstream rehype plugin filters dangerous tags or attributes. The parallel Mermaid path uses innerHTML assignment with a permissive security level, bypassing React's built-in escaping.

Attack Vector

Exploitation requires an attacker to add a document containing HTML payloads such as an <iframe srcdoc="..."> element or a crafted Mermaid block. When a victim later issues a query that retrieves the poisoned content, the WebUI renders the payload and executes JavaScript in the WebUI origin. The script can read the API token from localStorage and issue authenticated API requests as the victim.

text

// Patch: lightrag_webui/bun.lock — add rehype-sanitize dependency
         "rehype-katex": "^7.0.1",
         "rehype-raw": "^7.0.0",
         "rehype-react": "^8.0.0",
+        "rehype-sanitize": "^6.0.0",
         "remark-gfm": "^4.0.1",
         "remark-math": "^6.0.0",
         "seedrandom": "^3.0.5",

// Patch: lightrag_webui/src/components/retrieval/ChatMessage.tsx
 import remarkGfm from 'remark-gfm'
 import rehypeReact from 'rehype-react'
 import rehypeRaw from 'rehype-raw'
+import rehypeSanitize from 'rehype-sanitize'
 import remarkMath from 'remark-math'
 import mermaid from 'mermaid'
 import { remarkFootnotes } from '@/utils/remarkFootnotes'
+import { chatMarkdownSanitizeSchema } from '@/utils/markdownSanitizeSchema'

Source: GitHub Commit 8bf032a

Detection Methods for CVE-2026-86062

Indicators of Compromise

Documents in the LightRAG corpus containing <iframe>, <script>, srcdoc, or event handler attributes such as onload= and onerror=.
Mermaid code blocks that contain HTML entities or embedded script-like syntax intended to reach the SVG innerHTML sink.
Unexpected outbound requests from browsers rendering LightRAG chat responses to attacker-controlled hosts.

Detection Strategies

Scan ingested documents and query responses for raw HTML tags before they reach the WebUI renderer.
Inspect browser console and network telemetry for unexpected script execution or localStorage reads within the LightRAG WebUI origin.
Review web server access logs for API calls that correlate with chat rendering events rather than deliberate user actions.

Monitoring Recommendations

Enable a Content Security Policy (CSP) on the WebUI that blocks inline scripts and iframe sources not on an allowlist.
Audit document upload activity for accounts that submit HTML-heavy payloads to the RAG corpus.
Alert on API token usage patterns that deviate from a user's normal session, such as requests originating shortly after chat rendering.

How to Mitigate CVE-2026-86062

Immediate Actions Required

Upgrade LightRAG to version 1.5.5 or later, which introduces rehype-sanitize with the chatMarkdownSanitizeSchema in ChatMessage.tsx.
Rotate any LightRAG API tokens that may have been exposed to WebUI users during the vulnerable window.
Review the document corpus and remove entries containing raw HTML, iframe srcdoc payloads, or suspicious Mermaid blocks.

Patch Information

The fix is delivered in LightRAG v1.5.5 via pull request #3437 and commit 8bf032a. The patch adds rehype-sanitize to the Markdown pipeline and applies a restrictive schema to chat content. See the GitHub Security Advisory GHSA-xpjq-3w4w-w5wr for full details.

Workarounds

Restrict document ingestion to trusted users until the upgrade is applied.
Deploy a strict CSP that disallows inline scripts, iframe embedding, and cross-origin script sources on the WebUI.
Move the API token out of localStorage to a storage mechanism inaccessible to page scripts, such as an HttpOnly cookie proxied by a backend.

bash

# Upgrade LightRAG to the patched release
pip install --upgrade "lightrag-hku>=1.5.5"

# Verify installed version
python -c "import lightrag; print(lightrag.__version__)"