2312 matches found
Open WebUI 跨站脚本漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in Open WebUI version 0.6.34 and earlier, which stems from a failure to clean up the prompt body when assigning it to the DOM receiver innerHtml, whi...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version 0.6.224 and earlier, which stems from a code injection vulnerability in the Direct Connections feature that could lead to authentication...
CVE-2025-64496: Improper Neutralization of Directives in Dynamically Evaluated Code
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers vi...
Inclusion of Web Functionality from an Untrusted Source
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Inclusion of Web Functionality from an Untrusted Source via the execute event handler used by the Direct Connections feature. An attacker can gain access to authentication tokens, take over user accounts, and...
GHSA-CM35-V4VP-5XVX Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
Summary Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event SSE execute events. This leads to authentication token theft, comple...
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant ...
GHSA-W7XJ-8FX7-WFCH Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant ...
Cross-site Scripting (XSS)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the replaceCommandWithText function, by allowing user-controlled HTML from a prompt body to be passed to tempDiv.innerHTML without proper sanitization. An attacker can execute...
PT-2025-45528
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.224 and prior Open WebUI versions 0.6.34 and prior Open WebUI version 0.6.33 and prior Description Open WebUI, a self-hosted artificial intelligence platform, contains a code injection vulnerability within the Direct...
PT-2025-45781
Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant ...
PT-2025-45527
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 and below Description Open WebUI, a self-hosted artificial intelligence platform designed for offline operation, contains a Stored DOM XSS issue. When the 'Insert Prompt as Rich Text' functionality is enabled, the...
CVE-2025-6176 vulnerabilities
Vulnerabilities for packages: mitmproxy...
CVE-2025-6176 vulnerabilities
Vulnerabilities for packages: pgadmin4, mitmproxy, nemo, superset...
GHSA-7F5H-V6XP-FCQ8 vulnerabilities
Vulnerabilities for packages: nemo, kserve, reflex, mlflow, open-webui, k8s-sidecar, airflow, airflow-core...
CVE-2025-62707 vulnerabilities
Vulnerabilities for packages: nemo, open-webui...
CVE-2025-62708 vulnerabilities
Vulnerabilities for packages: nemo, open-webui...
GHSA-JFX9-29X2-RV3J vulnerabilities
Vulnerabilities for packages: nemo, open-webui...
GHSA-VR63-X8VC-M265 vulnerabilities
Vulnerabilities for packages: nemo, open-webui...