Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hkuds/lightrag

              main @ 3363a47
            

Fixes

CVEs

HIGH

Peak severity

47.1%

Coverage

Highlights

Denial of Service: 29 prior fixes. Scrutinize any change in this area.

lightrag/kg/postgres_impl.py: most-fixed (8 issues). Treat as high-risk during review.

42 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure token validation allowed JWT signature forgery. Specifically, the system accepted the 'none' algorithm and lacked validation on default signing secrets. This was assigned CVE-2026-39413.

Path Traversal: Document management, asset extraction, and workspace endpoints frequently failed to sanitize user-supplied filenames, allowing directory traversal and arbitrary file read/write operations outside designated input directories.

Cypher Injection: Dynamic string interpolation of workspace parameters, property keys, and node labels in graph databases (Neo4j, Memgraph, and AGE/PostgreSQL) created severe SQL and Cypher injection surfaces.