MAL-2026-10010 Malicious code in feedback-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b010aedb75591ab2ecad503373bbb8f0bb2bd98637c2e7c68aff89ec3ab26a1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-45396 Open WebUI: Mass Assignment via FeedbackForm extra=allow Allows Feedback User ID Spoofing and Evaluation Data Manipulation

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, the POST /api/v1/evaluations/feedback endpoint in Open WebUI v0.9.2 is vulnerable to mass assignment via FeedbackForm, which uses modelconfig = ConfigDictextra='allow'. Due to an...