Product
LightRAG versions 1.5.4 and earlier are vulnerable to Server-Side Request Forgery (SSRF) because the markdown parser fails to sanitize IPv6-encoded internal IPv4 addresses, allowing access to internal services and cloud metadata.