CVE-2026-86062

### Summary The LightRAG WebUI renders assistant/answer chat content as **raw HTML** — `react-markdown` is configured with `rehypePlugins={[rehypeRaw]}` and `skipHtml={false}` and **no** HTML sanitizer (`rehype-sanitize`), element allow-list, or custom `urlTransform`. Because answer content is derived from user-ingested documents, an attacker who can add a single document can store an HTML/JavaScript payload that executes in the browser of any user who later retrieves it (typically an administrator), leading to auth-token theft from `localStorage` and full API takeover. No authentication is required in the default configuration. ### Details Sink — `lightrag_webui/src/components/retrieval/ChatMessage.tsx`: - Main answer (`MessageMarkdown`, lines ~348-351) and thinking content (lines ~252-272) render with `rehypePlugins={[rehypeRaw, …]}` and `skipHtml={false}`. The `components` map (lines ~111-156) only restyles safe formatting tags (`p`, `h1`–`h4`, `ul`, `ol`, `li`, `code`); there is no `rehype-sanitize`, no `allowedElements`/`disallowedElements`, and no custom `urlTransform`. - Second sink: mermaid is initialized with `securityLevel: 'loose'` (line ~433) and the rendered SVG is injected via `container.innerHTML = svg` (line ~483) + `bindFunctions(container)`. `'loose'` disables mermaid's output sanitization, so a ` ```mermaid ` block in answer content (HTML label / `click` directive) is an additional script-execution path. - Hardening (not code execution): KaTeX is set with `trust: true` (lines ~261/~359). `\href{javascript:…}` is blocked by React 19, but `\includegraphics{URL}` renders a live remote `<img src>` (arbitrary external resource load from the victim's browser). Recommend `trust: false`. Source → sink: `POST /documents/text` or `POST /documents/upload` stores the document → `POST /query` returns it (verbatim when `only_need_context=true`, `lightrag/api/routers/query_routes.py:27`; otherwise echoed by the LLM) → the response is streamed i