A stored XSS flaw exists in the LightRAG WebUI chat responder, allowing an attacker to inject arbitrary HTML or JavaScript into retrieved answers. The injected script is executed in the victim’s browser context, permitting an attacker to read the API token stored in localStorage and perform authenticated API requests as the user. The weakness stems from rendering user‑supplied content with react-markdown and rehypeRaw without an HTML sanitizer.

LightRAG versions prior to 1.5.5 are affected. The vulnerability is present in the component that renders chat messages and thinking content and is not mitigated in any earlier releases of the product.

The CVSS score of 6.1 indicates a medium severity. An attacker with the ability to add a document can persist malicious content, and any user retrieving that content will be impacted. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that large‑scale exploitation is not currently documented. Nevertheless, the attack requires only the insertion of a document, a permission that many users may possess, and does not demand advanced access or code execution on the server side.