{"action":"Upgrade lightrag-hku to 1.5.4 or later.","affected":[{"fixed":"1.5.4","introduced":"0"}],"component":"lightrag-hku","cve_ids":["CVE-2026-61736"],"ecosystem":"PyPI","epss":0.01422,"exploited":false,"fixed_versions":["1.5.4"],"ghsa_id":"GHSA-6x6h-qqr7-855w","id":"tcs_01M5KH5HE699CWKD2NT0CGE9X9","modified_at":"2026-07-23T15:00:12.437223905Z","published_at":"2026-07-23T11:41:47.793467Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3474","https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w","https://nvd.nist.gov/vuln/detail/CVE-2026-61736","https://github.com/HKUDS/LightRAG/pull/3317","https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d","https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d","https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252","https://github.com/HKUDS/LightRAG","https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4","https://pypi.org/project/lightrag-hku","https://github.com/advisories/GHSA-6x6h-qqr7-855w"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-3474","url":"https://osv.dev/vulnerability/PYSEC-2026-3474"}],"summary":"LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests"}