LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content by MessageMarkdown. A user who later retrieves the content can execute attacker-controlled JavaScript through elements such as an iframe srcdoc; the additional Mermaid securityLevel: loose rendering path also injects generated SVG through innerHTML. The script runs in the LightRAG WebUI origin and can read the API token in localStorage and perform API actions as the victim. This issue is fixed in version 1.5.5.

Affected: PyPI: lightrag-hku

### Summary The LightRAG WebUI renders assistant/answer chat content as **raw HTML** — `react-markdown` is configured with `rehypePlugins={[rehypeRaw]}` and `skipHtml={false}` and **no** HTML sanitizer (`rehype-sanitize`), element allow-list, or custom `urlTransform`. Because answer content is derived from user-ingested documents, an attacker who can add a single document can store an HTML/JavaScript payload that executes in the browser of any user who later retrieves it (typically an administrator), leading to auth-token theft from `localStorage` and full API takeover. No authentication is required in the default configuration.

### Details Sink — `lightrag_webui/src/components/retrieval/ChatMessage.tsx`: - Main answer (`MessageMarkdown`, lines ~348-351) and thinking content (lines ~252-272) render with `rehypePlugins={[rehypeRaw, …]}` and `skipHtml={false}`. The `components` map (lines ~111-156) only restyles safe formatting tags (`p`, `h1`–`h4`, `ul`, `ol`, `li`, `code`); there is no `rehype-sanitize`, no `allowedElements`/`disallowedElements`, and no custom `urlTransform`. - Second sink: mermaid is initialized with `securityLevel: 'loose'` (line ~433) and the rendered SVG is injected via `container.innerHTML = svg` (line ~483) + `bindFunctions(container)`. `'loose'` disables mermaid's output sanitization, so a ` ```mermaid ` block in answer content (HTML label / `click` directive) is an additional script-execution path. - Hardening (not code execution): KaTeX…