CVE-2026-109291

Open WebUI versions 0.6.33 before 0.11.4 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly neutralize input, allowing authenticated users to store javascript: URLs within citation embed_url fields. An attacker can share a crafted chat where clic...

EUVD-2026-97593

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-108741

The Shepherd (shepherd-ai) software, version 0.3.1 and below, is vulnerable to a Server-Side Request Forgery (SSRF) via DNS Rebinding in the citation-checker extra. The root cause is a Time-of-check Time-of-use (TOCTOU) race condition where the public_url guard validates a resolved address, but t...

EUVD-2026-96907

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

CVE-2026-108741 Shepherd through 0.3.1 SSRF via DNS Rebinding in Citation Checker

Shepherd shepherd-ai through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the publicurl guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and...

CVE-2025-4102025

Security Advisory: CVE-2025-4102025 Summary A critical vulnerability has been discovered in Copilot AI affecting how web query citation links are rendered after Retrieval-Augmented Generation RAG operations. When users request page summaries or perform web-based queries, all subsequent citation...

CVE-2026-108583

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing...

Assessing Attack Surfaces in Generative Search Engines through Publisher Attributes: A Case Study in Political Domains

We characterize the attack surface of generative search engines GSEs against poisoning attacks in the political domain, from the perspectives of citation selection and personalization. GSEs integrate web search and answer generation with user preferences and backgrounds using large language model...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

PT-2026-59409

Summary Manually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the CitationModal process. An attacker can execute arbitrary JavaScript in the context of another user's session by crafting a malicious document payload and manipulating the html...

PT-2026-31772

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description OpenClaw before version 2026.3.22 performs cite expansion before completing channel and direct message DM authorization checks. This allows cite work and content handling to occur before final...

CVE-2026-31989

OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in websearch citation redirect resolution that uses a private-network-allowing SSRF policy. An attacker who can influence citation redirect targets can trigger internal-network requests from the OpenClaw host ...

EUVD-2026-14582

OpenClaw before 2026.3.1 contains a server-side request forgery vulnerability in websearch citation redirect resolution that allows attackers to target private-network destinations. Attackers who influence citation redirect targets can trigger internal-network requests from the OpenClaw gateway...

CVE-2026-32902

Rejected reason: This CVE ID has been rejected...

CVE-2026-32902

...

CVE-2026-32902

OpenClaw vulnerable before 2026.3.1 due to a server-side request forgery in web_search citation redirect resolution, enabling an attacker to induce the gateway host to make internal-network requests to private destinations. The issue arises from how citation redirects are resolved and can lead to...

PT-2026-27236

OpenClaw before 2026.3.1 contains a server-side request forgery vulnerability in web search citation redirect resolution that allows attackers to target private-network destinations. Attackers who influence citation redirect targets can trigger internal-network requests from the OpenClaw gateway...

Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-g99v-8hwm-g76g. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.3.1 contain a server-side request forgery vulnerability in websearch citation redirec...