lightrag-hku 1.4.9.9

Direct Vulnerabilities

Known vulnerabilities in the lightrag-hku package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
C Use of Hard-coded Credentials lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the authentication process when a hardcoded default token secret is used and certain endpoints such as `/auth-status` and `/login` are exposed without proper authentication checks. An attacker can gain unauthorized access to protected API endpoints and perform destructive actions, such as reading, deleting, or uploading documents, clearing caches, and running arbitrary queries, by minting a valid guest JWT offline or obtaining one from the unauthenticated endpoints. This is only exploitable if the server is configured with `LIGHTRAG_API_KEY` set and `AUTH_ACCOUNTS` unset. How to fix Use of Hard-coded Credentials? Upgrade `lightrag-hku` to version 1.5.4 or higher.	[,1.5.4)
H Permissive Cross-domain Policy with Untrusted Domains lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains in the CORS configuration process. An attacker can gain unauthorized access to sensitive user data and perform actions on behalf of authenticated users by enticing a logged-in user to visit a malicious website, which then makes credentialed cross-origin requests to the server. How to fix Permissive Cross-domain Policy with Untrusted Domains? Upgrade `lightrag-hku` to version 1.5.4 or higher.	[,1.5.4)
H Improper Authentication lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Improper Authentication via the file `lightrag/api/config.py` that uses a default JWT secret "lightrag-jwt-default-secret" when the `TOKEN_SECRET` environment variable is not set. The AuthHandler in `lightrag/api/auth.py` uses this secret to sign and verify tokens. An unauthenticated attacker can forge valid JWT tokens using the publicly known default secret and gain access to any protected endpoint. How to fix Improper Authentication? Upgrade `lightrag-hku` to version 1.4.13 or higher.	[,1.4.13)
C Improper Verification of Cryptographic Signature lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the `validate_token()` function. An attacker can gain unauthorized access to protected resources by crafting a JWT with the 'alg' header set to 'none', allowing them to impersonate any user, including administrators. How to fix Improper Verification of Cryptographic Signature? Upgrade `lightrag-hku` to version 1.4.14 or higher.	[,1.4.14)

Vulnerability

Vulnerable Version

Use of Hard-coded Credentials

lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation

Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the authentication process when a hardcoded default token secret is used and certain endpoints such as /auth-status and /login are exposed without proper authentication checks. An attacker can gain unauthorized access to protected API endpoints and perform destructive actions, such as reading, deleting, or uploading documents, clearing caches, and running arbitrary queries, by minting a valid guest JWT offline or obtaining one from the unauthenticated endpoints. This is only exploitable if the server is configured with LIGHTRAG_API_KEY set and AUTH_ACCOUNTS unset.

How to fix Use of Hard-coded Credentials?

Upgrade lightrag-hku to version 1.5.4 or higher.

[,1.5.4)

Permissive Cross-domain Policy with Untrusted Domains

lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains in the CORS configuration process. An attacker can gain unauthorized access to sensitive user data and perform actions on behalf of authenticated users by enticing a logged-in user to visit a malicious website, which then makes credentialed cross-origin requests to the server.

How to fix Permissive Cross-domain Policy with Untrusted Domains?

Upgrade lightrag-hku to version 1.5.4 or higher.

[,1.5.4)

Improper Authentication

lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation

Affected versions of this package are vulnerable to Improper Authentication via the file lightrag/api/config.py that uses a default JWT secret "lightrag-jwt-default-secret" when the TOKEN_SECRET environment variable is not set. The AuthHandler in lightrag/api/auth.py uses this secret to sign and verify tokens. An unauthenticated attacker can forge valid JWT tokens using the publicly known default secret and gain access to any protected endpoint.

How to fix Improper Authentication?

Upgrade lightrag-hku to version 1.4.13 or higher.

[,1.4.13)

Improper Verification of Cryptographic Signature

lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validate_token() function. An attacker can gain unauthorized access to protected resources by crafting a JWT with the 'alg' header set to 'none', allowing them to impersonate any user, including administrators.

How to fix Improper Verification of Cryptographic Signature?

Upgrade lightrag-hku to version 1.4.14 or higher.

[,1.4.14)

lightrag-hku@1.4.9.9

LightRAG: Simple and Fast Retrieval-Augmented Generation

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically