https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 04:15:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-70480 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets into the rendered page. This issue is fixed in 0.11.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets into the rendered page. This issue is fixed in 0.11.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-70480 https://cve.radiocsirt.org/vuln/ghsa-rffm-9q57-q649 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary Open WebUI renders `vega` and `vega-lite` fenced code blocks in chat content by building a Vega view in the viewer&#39;s browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user&#39;s browser issue attacker-chosen outbound GET requests, and read back responses from same-origin or CORS-permissive targets into the rendered page. Because the request comes from the browser, server-side SSRF protections never see it.</p> <p>## Preconditions Default configuration, no flags or environment variables involved: Vega blocks render unconditionally wherever chat content is displayed. The attacker needs an account that can put content in front of the victim, which covers a shared chat, a channel message, and model, RAG or tool output the attacker can influence. The victim must open the message, so this is not zero-click. Deployments where the victim&#39;s browser has no network position of interest lose little.</p> <p>## Impact The victim&#39;s browser becomes a request proxy into whatever it can reach: internal hosts and ports behind the perimeter, same-site endpoints, and out-of-band beacons that confirm a chart was viewed and by whom. Where the target is same-origin or returns permissive CORS headers, the response body is pulled back into the chart in the victim&#39;s page, which turns the request into a read. Requests are GET only, and no server-side data is exposed to the attacker directly.</p> <p>## Fix Fixed in 5278eb906 (#26806), rel…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>## Summary Open WebUI renders `vega` and `vega-lite` fenced code blocks in chat content by building a Vega view in the viewer&#39;s browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user&#39;s browser issue attacker-chosen outbound GET requests, and read back responses from same-origin or CORS-permissive targets into the rendered page. Because the request comes from the browser, server-side SSRF protections never see it.</p> <p>## Preconditions Default configuration, no flags or environment variables involved: Vega blocks render unconditionally wherever chat content is displayed. The attacker needs an account that can put content in front of the victim, which covers a shared chat, a channel message, and model, RAG or tool output the attacker can influence. The victim must open the message, so this is not zero-click. Deployments where the victim&#39;s browser has no network position of interest lose little.</p> <p>## Impact The victim&#39;s browser becomes a request proxy into whatever it can reach: internal hosts and ports behind the perimeter, same-site endpoints, and out-of-band beacons that confirm a chart was viewed and by whom. Where the target is same-origin or returns permissive CORS headers, the response body is pulled back into the chart in the victim&#39;s page, which turns the request into a read. Requests are GET only, and no server-side data is exposed to the attacker directly.</p> <p>## Fix Fixed in 5278eb906 (#26806), rel…</p> https://cve.radiocsirt.org/vuln/ghsa-rffm-9q57-q649