PYSEC-2026-2749 Open WebUI's Model Import Overwrites Any Model Without Ownership Check

Model Import Overwrites Any Model Without Ownership Check Affected Component Model import endpoint: - backend/openwebui/routers/models.py lines 254-308, importmodels Affected Versions Current main branch commit 6fdd19bf1 and likely all versions with model import functionality. Description The POS...

PYSEC-2026-2719 Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Base Model Routing Bypasses Access Control via Model Chaining Affected Component Model chaining via basemodelid: - backend/openwebui/routers/models.py lines 170-214, createnewmodel - backend/openwebui/routers/models.py lines 254-308, importmodels - backend/openwebui/main.py lines 1696-1711, base...

PYSEC-2026-2735 Open WebUI's Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts

Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts Affected Component Folder creation endpoint and form model: - backend/openwebui/models/folders.py lines 72-77, FolderForm with extra='allow' - backend/openwebui/models/folders.py lines 95-106,...

PYSEC-2026-2725 open-webui Vulnerable to Stored XSS via Model Description

!IMPORTANT Relationship to CVE-2024-7990 CVE-2024-7990 issued by huntr.dev, March 2025 describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder...

PYSEC-2026-2734 Open WebUI's responses passthrough endpoint lacks access control authorization

Summary The /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While the primary chat completion endpoint generatechatcompletion checks model ownership, group membership, and...

Open WebUI's Base Model Routing Bypasses Access Control via Model Chaining

Base Model Routing Bypasses Access Control via Model Chaining Affected ComponentModel chaining via basemodelid:- backend/openwebui/routers/models.py lines 170-214, createnewmodel- backend/openwebui/routers/models.py lines 254-308, importmodels- backend/openwebui/main.py lines 1696-1711, base mode...

open-webui Vulnerable to Stored XSS via Model Description

!IMPORTANT Relationship to CVE-2024-7990 CVE-2024-7990 issued by huntr.dev, March 2025 describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder...

Open WebUI's responses passthrough endpoint lacks access control authorization

SummaryThe /responses endpoint in the OpenAI router accepts any authenticated user and forwards requests directly to upstream LLM providers without enforcing per-model access control. While the primary chat completion endpoint generatechatcompletion checks model ownership, group membership, and...

vitamin-model-checker (>=0.2.0, <=1.5.0), vitamin-model-checker-test (>=0.8.0, <=1.0.0) potentially affected by CVE-2026-42557 via jupyterlab (3.4.7)

jupyterlab PYPI version 3.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - vitamin-model-checker =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-2537...

cr (1.5.0), cryton-worker (2022.2.2) +5 more potentially affected by CVE-2026-44405 via paramiko (2.11.1)

paramiko PYPI version 2.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - cr 1.5.0 - cryton-worker 2022.2.2 - kubemarine =0.13.1, =1.2.60, =1.5.2, =1.9.0 Source cves: CVE-2026-44405 Source advisory: OSV:PYSEC-2026-285...

PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

Summary This vulnerability has been fixed in https://github.com/icip-cas/PPTAgent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00.CodeExecutor.executeactions pptagent/apis.py:126-205 processes LLM-generated slide editing actions using Python's eval: python pptagent/apis.py:184-186partialfunc =...

vitamin-model-checker (>=0.2.0, <=1.5.0), vitamin-model-checker-test (>=0.8.0, <=1.0.0) potentially affected by CVE-2026-40171 via jupyterlab (3.4.7)

jupyterlab PYPI version 3.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - vitamin-model-checker =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-2538...

InstructLab Includes Functionality from Untrusted Control Sphere

A flaw was found in InstructLab. The linuxtrain.py script hardcodes trustremotecode=True when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run ilab train/download/generate with a specially crafted malicious model...

PYSEC-2026-2484 FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...

FastChat has Denial of Service Through Blocking Event Loop in Model Workers (Incomplete Fix for ff66426)

A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function apigenerate of the component Worker API Endpoint. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed publicly and may be...

PYSEC-2026-3419 wger has Stored XSS via Unescaped License Attribution Fields

Stored XSS via Unescaped License Attribution Fields Summary The AbstractLicenseModel.attributionlink property in wger/utils/models.py constructs HTML strings by directly interpolating user-controlled fields licenseauthor, licensetitle, licenseobjecturl, licenseauthorurl, licensederivativesourceur...

gesture-classifying-model (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-1462 via keras (1.2.2)

keras PYPI version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - gesture-classifying-model =0.1.2, =0.1.3 Source cves: CVE-2026-1462 Source advisory: OSV:PYSEC-2026-2547...

keras-eval (>=0.0.4, <=0.0.8), keras-model-specs (>=0.0.17, <=0.0.24) +3 more potentially affected by CVE-2026-1462 via keras (2.1.4)

keras PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-eval =0.0.4, =0.0.17, =0.0.21, =0.1.2, =0.5.2 Source cves: CVE-2026-1462 Source advisory: OSV:PYSEC-2026-2547...

K000162232: Spring AI vulnerability CVE-2026-41713

Security Advisory Description A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversati...

PYSEC-2026-2918 PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

PraisonAI’s MCP Model Context Protocol integration allows spawning background servers via stdio using user-supplied command strings e.g., MCP"npx -y @smithery/cli ...". These commands are executed through Python’s subprocess module. By default, the implementation forwards the entire parent proces...