A stored cross-site scripting vulnerability in LightRAG allows unauthenticated attackers to execute malicious JavaScript in the context of a victim's session, potentially leading to full account takeover.

This is a stored cross-site scripting (CWE-79) vulnerability occurring in the ChatMessage component. By injecting malicious HTML into a document, an attacker can force the browser to render arbitrary scripts, which operate with the privileges of the authenticated user.

The exploitation of this vulnerability poses a significant risk to data confidentiality and integrity. Because the injected scripts can access local storage, an attacker can steal sensitive API tokens, effectively hijacking user sessions and performing unauthorized actions within the LightRAG environment. Although the CVSS score is 6.1, the ability to perform actions as an authenticated user elevates the actual operational risk to critical.

Immediate Action: Upgrade to LightRAG version 1.5.5 or later immediately to incorporate the required HTML sanitization.

Proactive Monitoring: Review web access logs for unusual document submission patterns or attempts to inject iframe and svg tags into the retrieval system.

Compensating Controls: Implement a strict Content Security Policy (CSP) that restricts script execution to trusted domains, which can mitigate the impact of XSS attacks while the update is being deployed.

Public Exploit Available: Unknown.

Organizations utilizing LightRAG must prioritize the update to version 1.5.5. Given the potential for session hijacking and unauthorized API usage through stored XSS, failure to patch leaves the application and its users vulnerable to credential theft and lateral movement. Apply the update as soon as possible to neutralize this attack vector.