pkg:PyPI/lightrag-hku

All known vulnerabilities

• CRITICAL9.3CVE-2026-61736LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
  from 0, < 1.5.4
• HIGH7.5CVE-2026-30762LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
  from 0, < 1.4.13
• HIGH7.5CVE-2026-30762LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass
  from 0, < 1.4.13
• MEDIUM5.3HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
  from 0, < 1.3.8
• MEDIUM5.3HKUDS LightRAG allows Path Traversal via function upload_to_input_dir
  from 0, < 1.3.8
• MEDIUM4.2lightrag-hku: JWT Algorithm Confusion Vulnerability
  from 0, < 1.4.14
• MEDIUM4.2lightrag-hku: JWT Algorithm Confusion Vulnerability
  from 0, < 1.4.14
• —LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection
  from 0, < 1.5.4