GHSA-9F4F-JV96-8766 Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions

Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's...

EUVD-2026-40451

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

CVE-2026-56399

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

CVE-2026-56399

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

CVE-2026-56399 Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web

Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1/retrieval/process/web endpoint that allows authenticated users to bypass SSRF protections. Attackers can manipulate URL parameters with location redirect headers to access internal services and potentiall...

CVE-2026-56399

Open WebUI (pre-0.6.27) contains a server-side request forgery in the /api/v1/retrieval/process/web endpoint. The vulnerability allows authenticated users to bypass SSRF protections by manipulating URL parameters with location redirect headers, enabling access to internal services and potentially...

CVE-2026-54531 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-GR75-JV2W-4656 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-52X6-GQ3R-VPF4 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-M2V9-299J-RV96 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-54530 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2025-3000 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-52X6-GQ3R-VPF4 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-JM82-FX9C-MX94 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-54530 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-GR75-JV2W-4656 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-M2V9-299J-RV96 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-RRMF-RVHW-RF47 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-54018

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validateurl function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only ...

CVE-2026-54021

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy routes accept a caller-supplied urlidx path parameter and use it as a raw index into the admin-configured OLLAMABASEURLS list. Access...