{"action":"Upgrade lightrag-hku to 1.5.5 or later.","affected":[{"fixed":"1.5.5","introduced":"0"}],"component":"lightrag-hku","cve_ids":["CVE-2026-85725"],"ecosystem":"PyPI","epss":0.00446,"exploited":false,"fixed_versions":["1.5.5"],"ghsa_id":"GHSA-c759-cx9p-mrwq","id":"tcs_01M5KFCDW8QKRQ6TTW0TKGZXG7","modified_at":"2026-10-01T17:55:55.036612025Z","published_at":"2026-09-22T20:40:19Z","references":["https://osv.dev/vulnerability/GHSA-c759-cx9p-mrwq","https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq","https://nvd.nist.gov/vuln/detail/CVE-2026-85725","https://github.com/HKUDS/LightRAG/pull/3423","https://github.com/HKUDS/LightRAG/commit/89849c3ed0e0380345a6b5bade027cfb9a5bf32c","https://github.com/HKUDS/LightRAG","https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-c759-cx9p-mrwq","url":"https://osv.dev/vulnerability/GHSA-c759-cx9p-mrwq"}],"summary":"lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function"}