AIKIDO-2026-168553

TL;DR

The LightRAG WebUI chat renderer in ChatMessage.tsx renders assistant answer content as raw HTML using react-markdown with rehypeRaw and skipHtml={false} and no HTML sanitizer, element allow-list, or URL transform. Because answer content is derived from user-ingested documents, a client who can add a single document can store an HTML/JavaScript payload that executes in the browser of any user who later retrieves it. The injected script can read the auth token from localStorage and drive the API as the victim, escalating to full account takeover. The fix sanitizes untrusted chat Markdown before rendering.