Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

HKUDS/LightRAG

              main @ 18f99b6
            

127

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Denial of Service: 48 prior fixes. Scrutinize any change in this area.

lightrag/api/routers/document_routes.py: most-fixed (22 issues). Treat as high-risk during review.

66 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Multiple unbounded network reads and resource exhaustion in image downloader, including slow-loris stalls, unbounded redirects, and missing budgets.

Auth Bypass: Multiple whitelist path matching flaws allowed unauthenticated access to entire API, including prefix matching and mount prefix normalization issues.

Path Traversal: Multiple file operations (upload, delete, workspace path) lacked canonicalization and containment checks, enabling arbitrary file read/write/delete.