Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
7 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Banner component due to an improper sanitization order (specifically, DOMPurify is executed before the marked library). This vulnerability allows a compromised or malicious administrator to plant a malicious payload in the global banner. Crucially, this vector enables Privilege Escalation, as the malicious banner is rendered for all users, including the Super Admin (Primary Admin). Consequently, the payload successfully bypasses the existing security mechanism. An attacker can leverage this to steal the Super Admin's session token Details Root Cause: The code attempts to sanitize the input using DOMPurify.sanitize() before parsing it with marked.parse(). DOMPurify cleans the raw input. Since Link)) is valid text (not HTML), it passes through DOMPurify unchanged. marked handles the text and converts it into a clickable HTML link: <a href="javascript:alert(javascript:alert(localStorage.token))"Link</a. This…
Recommended action: Upgrade to 0.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The tool update endpoint (POST /api/v1/tools/id/{id}/update) is missing the workspace.tools permission check that is present on the tool create endpoint. This allows a user who has been explicitly denied tool management capabilities ( and who the administrator considers untrusted for code execution ) to replace a tool's server-side Python content and trigger execution, bypassing the intended workspace.tools security boundary. Open WebUI's security policy correctly states that workspace.tools is the trust boundary for code execution: "Granting a user the ability to create Tools is equivalent to giving them shell access to the server." This vulnerability breaks that boundary. A write access grant on a single tool is sufficient to bypass workspace.tools entirely. This is not a report about exec() being unsandboxed (that is acknowledged as intended behavior). This is a report about a missing authorization check that allows an untrusted user to reach the exec() sink that should be…
Recommended action: Upgrade to 0.9.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. Details It is possible permanently save any HTML/JavaScript code in the application, which can be then executed in the context of the application domain. This behaviour can be used to extract and steal sensitive data from the application, manipulate DOM tree or being used in complex client-side attacks. Detailed step-by-step instruction provided below. Please keep me updated about assigned CVE identifier. I'd like to be credited as: Jakub Żoczek [Securitum] PoC Steps to reproduce: To reproduce this vulnerability you need to: 1. Login to Open WebUI 2. Start new conversation / thread 3. Use prompt: "Hey. Can you draw me a green circle using SVG ?" 4. SVG image should be generated. 5. Now it's possible to edit the code by simply clicking on it and adding additional code. Add payload <img src=a onerror=alert(document.domain) 6. The whole code should look like this: <img width="1249" alt="AI…
Recommended action: Upgrade to 0.6.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
[!IMPORTANT] Relationship to CVE-2024-7990 CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder restoration logic in v0.3.x. That bypass was closed in v0.4.0 by removing the video exemption from the sanitizer. The vulnerability described in this advisory is structurally distinct: a markdown-link payload with a javascript: URI passes through sanitizeResponseContent unchanged (no angle brackets), is then parsed by marked.parse() into an <a href="javascript:..." element, and rendered live by {@html}. This is a pipeline-ordering flaw where the dangerous construct is introduced after sanitization completes. Removing the video exemption has no effect on this primitive. Affected range: v0.3.5 through v0.8.12 inclusive. Fixed in: v0.9.0 (commit 5eab125, which wraps marked.parse() output in…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. Details Vulnerability Location File: src/lib/components/notes/utils.ts Function: downloadPdf() Vulnerable Code (Line 35): Root Cause 1. Incomplete TipTap Editor Configuration - Open-WebUI only uses TipTap StarterKit - No Schema definition for dangerous tags like SVG, Script - Unknown HTML tags are stored as raw HTML 2. Missing Sanitization During PDF Generation - note.data.content.html is directly assigned to innerHTML - No DOMPurify or other sanitization - Stored malicious…
Recommended action: Upgrade to 0.6.37 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. Details ROOT CAUSE ANALYSIS: Open WebUI's Direct Connections feature allows users to add external OpenAI-compatible model servers without proper validation of the Server-Sent Events (SSE) these servers emit. VULNERABLE COMPONENT: Frontend SSE Event Handler The frontend JavaScript code processes SSE events from external servers and specifically handles an execute event type that…
Recommended action: Upgrade to 0.6.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant a payload that could be triggered by other users if they run the corresponding / command to insert the prompt. Details The affected line is https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/src/lib/components/common/RichTextInput.svelte#L348 User controlled HTML from the prompt body is assigned to tempDiv.innerHTML without (meaningful) sanitisation. marked.parse introduces some character limitations but does not sanitise the content, as stated in their README. <img width="1816" height="498" alt="image" src="https://github.com/user-attachments/assets/bd0980fc-ad87-460a-94b8-02bc94bea1a2" / PoC Create a custom prompt as follows: <img width="3006"…
Recommended action: Upgrade to 0.6.35 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.