AIKIDO-2026-10456
lightrag-hku is vulnerable to Cypher Injection
82
High Risk
This Affects:
lightrag-hkuTL;DR
The API reads the default workspace from --workspace / WORKSPACE during CLI parsing and can override it per request using the LIGHTRAG-WORKSPACE header. Before the fix, those values were passed through without normalizing the character set. The workspace string is used when building graph storage behavior (including Cypher-oriented backends); malicious content in the identifier can influence query construction. The fix applies the same allowlist-style normalization ([a-zA-Z0-9_], replacing other characters with _) immediately after resolving CLI/config and inside get_workspace_from_request, and logs when rewriting occurs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
lightrag-hku is vulnerable to Cypher Injection in versions 1.4.0 - 1.4.10.
How to fix this
Upgrade the lightrag-hku library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant