1466 matches found
Cross-site Scripting (XSS)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the replaceCommandWithText function, by allowing user-controlled HTML from a prompt body to be passed to tempDiv.innerHTML without proper sanitization. An attacker can execute...
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant ...
GHSA-W7XJ-8FX7-WFCH Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant ...
PT-2025-45528
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.224 and prior Open WebUI versions 0.6.34 and prior Open WebUI version 0.6.33 and prior Description Open WebUI, a self-hosted artificial intelligence platform, contains a code injection vulnerability within the Direct...
PT-2025-45527
Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 and below Description Open WebUI, a self-hosted artificial intelligence platform designed for offline operation, contains a Stored DOM XSS issue. When the 'Insert Prompt as Rich Text' functionality is enabled, the...
CVE-2025-6176 vulnerabilities
Vulnerabilities for packages: superset, mitmproxy...
CVE-2025-6176 vulnerabilities
Vulnerabilities for packages: superset, nemo, mitmproxy, pgadmin4...
GHSA-7F5H-V6XP-FCQ8 vulnerabilities
Vulnerabilities for packages: open-webui, reflex, airflow, airflow-core, mlflow, nemo, kserve, k8s-sidecar...
GHSA-VR63-X8VC-M265 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
GHSA-JFX9-29X2-RV3J vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
CVE-2025-62707 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
CVE-2025-62708 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
GHSA-VR63-X8VC-M265 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2025-62708 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-JFX9-29X2-RV3J vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2025-62707 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-M42M-M8CR-8M58 vulnerabilities
Vulnerabilities for packages: py3-langchain-text-splitters, open-webui...
CVE-2025-6985 vulnerabilities
Vulnerabilities for packages: py3-langchain-text-splitters, open-webui...