https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:12:14 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45314 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profile_image_url values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves this SVG as image/svg+xml without sanitization, allowing attacker-controlled script handlers (for example onload) to execute when the profile-image URL is opened in the browser. This vulnerability is fixed in 0.9.3.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the channel webhook create/update flow accepts arbitrary profile_image_url values, including data:image/svg+xml;base64,... payloads. The profile image endpoint then decodes and serves this SVG as image/svg+xml without sanitization, allowing attacker-controlled script handlers (for example onload) to execute when the profile-image URL is opened in the browser. This vulnerability is fixed in 0.9.3.</p> https://cve.radiocsirt.org/vuln/cve-2026-45314 https://cve.radiocsirt.org/vuln/ghsa-3856-3vxq-m6fc <p><strong>Affected:</strong> PyPI: open-webui</p> <p>As part of our research on improving our [AI pentest](https://www.aikido.dev/attack/aipentest), we have uncovered the following issue in Open WebUI. We&#39;ve manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report.</p> <p>### Summary</p> <p>The channel webhook create/update flow accepts arbitrary `profile_image_url` values, including `data:image/svg+xml;base64,...` payloads. The profile image endpoint then decodes and serves this SVG as `image/svg+xml` without sanitization, allowing attacker-controlled script handlers (for example onload) to execute when the profile-image URL is opened in the browser.</p> <p>### Details</p> <p>The server accepts `data:image/svg+xml;base64,...` values for `profile_image_url` when creating or updating a webhook. Later, `GET /api/v1/channels/webhooks/{webhook_id}/profile/image` detects `data:image`, base64-decodes it, derives the media type from the header (e.g., `image/svg+xml`), and returns a `StreamingResponse` with `Content-Disposition: inline` and `media_type` set to `image/svg+xml`. There is no sanitization or transformation. When this URL is opened in a browser, SVG event handlers such as onload execute in the application origin, resulting in stored XSS.</p> <p>### PoC</p> <p>1. Set up a new instance of Open WebUI and log in as admin 2. In the Admin Panel, enable *Channels (Beta)* and click Save 3. Create a low-privilege user in the Users tab 4. As the attacker, use the low-privilege user to run the following sc…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>As part of our research on improving our [AI pentest](https://www.aikido.dev/attack/aipentest), we have uncovered the following issue in Open WebUI. We&#39;ve manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report.</p> <p>### Summary</p> <p>The channel webhook create/update flow accepts arbitrary `profile_image_url` values, including `data:image/svg+xml;base64,...` payloads. The profile image endpoint then decodes and serves this SVG as `image/svg+xml` without sanitization, allowing attacker-controlled script handlers (for example onload) to execute when the profile-image URL is opened in the browser.</p> <p>### Details</p> <p>The server accepts `data:image/svg+xml;base64,...` values for `profile_image_url` when creating or updating a webhook. Later, `GET /api/v1/channels/webhooks/{webhook_id}/profile/image` detects `data:image`, base64-decodes it, derives the media type from the header (e.g., `image/svg+xml`), and returns a `StreamingResponse` with `Content-Disposition: inline` and `media_type` set to `image/svg+xml`. There is no sanitization or transformation. When this URL is opened in a browser, SVG event handlers such as onload execute in the application origin, resulting in stored XSS.</p> <p>### PoC</p> <p>1. Set up a new instance of Open WebUI and log in as admin 2. In the Admin Panel, enable *Channels (Beta)* and click Save 3. Create a low-privilege user in the Users tab 4. As the attacker, use the low-privilege user to run the following sc…</p> https://cve.radiocsirt.org/vuln/ghsa-3856-3vxq-m6fc