CyberRota Analysis
AI-GeneratedLightRAG versions prior to 1.5.4 are vulnerable due to a misconfiguration in CORS settings, which allows any origin to make credentialed cross-origin requests. This flaw can be exploited by malicious websites to perform unauthorized actions, such as exfiltrating sensitive data or deleting documents. Organizations using affected versions should prioritize upgrading to 1.5.4 to mitigate the risk of data breaches and potential loss of critical information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.