{"action":"Upgrade lightrag-hku to 1.5.5 or later.","affected":[{"fixed":"1.5.5","introduced":"0"}],"component":"lightrag-hku","cve_ids":["CVE-2026-85725"],"ecosystem":"PyPI","epss":0.00446,"exploited":false,"fixed_versions":["1.5.5"],"ghsa_id":"GHSA-c759-cx9p-mrwq","id":"tcs_01M5KH9JW2JJ16B8G9S47KW807","modified_at":"2026-10-01T17:45:03.126468924Z","published_at":"2026-10-01T16:38:37.356906Z","references":["https://osv.dev/vulnerability/PYSEC-2026-4061","https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq","https://nvd.nist.gov/vuln/detail/CVE-2026-85725","https://github.com/HKUDS/LightRAG/pull/3423","https://github.com/HKUDS/LightRAG/commit/89849c3ed0e0380345a6b5bade027cfb9a5bf32c","https://github.com/HKUDS/LightRAG","https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5","https://pypi.org/project/lightrag-hku","https://github.com/advisories/GHSA-c759-cx9p-mrwq"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"PYSEC-2026-4061","url":"https://osv.dev/vulnerability/PYSEC-2026-4061"}],"summary":"lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function"}