PyPI/lightrag-hku CVE-2026-39413: medium 4.2, EPSS 0.21%

lightrag-hku: JWT Algorithm Confusion Vulnerability

Action: Upgrade lightrag-hku to 1.4.14 or later.

pip install lightrag-hku==1.4.14

Affected

Fixed versions

Sources

• osv: GHSA-8ffj-4hx4-9pgf
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf
• https://nvd.nist.gov/vuln/detail/CVE-2026-39413
• https://github.com/HKUDS/LightRAG/commit/728f2e54509d93e0a44f929c7f83f2c88d6d291b
• https://github.com/HKUDS/LightRAG

CVE-2026-39413 · published 2026-04-08T00:17:50Z · modified 2026-07-13T16:43:36.700729517Z · JSON