{"action":"Upgrade lightrag-hku to 1.5.4 or later.","affected":[{"fixed":"1.5.4","introduced":"0"}],"component":"lightrag-hku","cve_ids":["CVE-2026-61736"],"ecosystem":"PyPI","epss":0.01422,"exploited":false,"fixed_versions":["1.5.4"],"ghsa_id":"GHSA-6x6h-qqr7-855w","id":"tcs_01M5KF4EN9HDE2517PCPDCD6HZ","modified_at":"2026-07-23T15:11:24.272287760Z","published_at":"2026-07-20T21:45:25Z","references":["https://osv.dev/vulnerability/GHSA-6x6h-qqr7-855w","https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w","https://nvd.nist.gov/vuln/detail/CVE-2026-61736","https://github.com/HKUDS/LightRAG/pull/3317","https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d","https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d","https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252","https://github.com/HKUDS/LightRAG","https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-6x6h-qqr7-855w","url":"https://osv.dev/vulnerability/GHSA-6x6h-qqr7-855w"}],"summary":"LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests"}