Vulnerability-Lookup

GHSA-R29H-37FJ-X2W6

Vulnerability from github – Published: 2026-05-14 20:21 – Updated: 2026-05-19 15:59

Summary

Open WebUI Has Stored Cross-Site Scripting in SVG Renderer

Details

Summary

There is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation.

Details

It is possible permanently save any HTML/JavaScript code in the application, which can be then executed in the context of the application domain. This behaviour can be used to extract and steal sensitive data from the application, manipulate DOM tree or being used in complex client-side attacks.

Detailed step-by-step instruction provided below. Please keep me updated about assigned CVE identifier. I'd like to be credited as: Jakub Żoczek [Securitum]

PoC

Steps to reproduce:

To reproduce this vulnerability you need to:

Login to Open WebUI
Start new conversation / thread
Use prompt: "Hey. Can you draw me a green circle using SVG ?"
SVG image should be generated.
Now it's possible to edit the code by simply clicking on it and adding additional code. Add payload <img src=a onerror=alert(document.domain)>
The whole code should look like this:

<svg width="100" height="100" xmlns="http://www.w3.org/2000/svg">
  <circle cx="50" cy="50" r="40" fill="green"/>
</svg><img src="a" onerror="alert(document.domain)">ok</img>

AI XSS1

Now clicking "Save", the new image should get rendered, and malicious code - executed (by popping alert).

AI XSS2

Such thread could be then shared and sent to other users.

Impact

Cross-Site Scripting allows attacker to execute malicious code in context of victim's browser. This way it could be used in malicious client-side attack achieving different things, depends on attacker's goal. Such thread with rendered SVG could be shared to other user (or administrator) and gain sensitive data or even takeover someone's account.

Severity

5.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.31"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45346"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:21:51Z",
    "nvd_published_at": "2026-05-15T22:16:55Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThere is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. \n\n### Details\n\nIt is possible permanently save any HTML/JavaScript code in the application, which can be then executed in the context of the application domain. This behaviour can be used to extract and steal sensitive data from the application, manipulate DOM tree or being used in complex client-side attacks. \n\nDetailed step-by-step instruction provided below. Please keep me updated about assigned CVE identifier. I\u0027d like to be credited as: **Jakub \u017boczek [[Securitum](https://www.securitum.com/)]**\n\n### PoC\n\nSteps to reproduce:\n\nTo reproduce this vulnerability you need to:\n\n1. Login to Open WebUI \n2. Start new conversation / thread\n3. Use prompt: \"Hey. Can you draw me a green circle using SVG ?\"\n4. SVG image should be generated. \n5. Now it\u0027s possible to edit the code by simply clicking on it and adding additional code. Add payload `\u003cimg src=a onerror=alert(document.domain)\u003e`\n6. The whole code should look like this:\n\n```\n\u003csvg width=\"100\" height=\"100\" xmlns=\"http://www.w3.org/2000/svg\"\u003e\n  \u003ccircle cx=\"50\" cy=\"50\" r=\"40\" fill=\"green\"/\u003e\n\u003c/svg\u003e\u003cimg src=\"a\" onerror=\"alert(document.domain)\"\u003eok\u003c/img\u003e\n```\n\n\u003cimg width=\"1249\" alt=\"AI XSS1\" src=\"https://github.com/user-attachments/assets/75167880-79ac-4510-9743-f99bf81a215d\" /\u003e\n\n7. Now clicking \"Save\", the new image should get rendered, and malicious code - executed (by popping alert). \n\n\u003cimg width=\"527\" alt=\"AI XSS2\" src=\"https://github.com/user-attachments/assets/24d4e572-97f0-438f-993d-08e1d421b349\" /\u003e\n\nSuch thread could be then shared and sent to other users. \n\n### Impact\nCross-Site Scripting allows attacker to execute malicious code in context of victim\u0027s browser. This way it could be used in malicious client-side attack achieving different things, depends on attacker\u0027s goal. Such thread with rendered SVG could be shared to other user (or administrator) and gain sensitive data or even takeover someone\u0027s account.",
  "id": "GHSA-r29h-37fj-x2w6",
  "modified": "2026-05-19T15:59:41Z",
  "published": "2026-05-14T20:21:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45346"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Open WebUI Has Stored Cross-Site Scripting in SVG Renderer"
}

CVE-2026-45346 (GCVE-0-2026-45346)

Vulnerability from cvelistv5 – Published: 2026-05-15 21:15 – Updated: 2026-05-18 12:48

Title

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CWE

CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/open-webui/open-webui/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
open-webui	open-webui	Affected: < 0.6.31

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45346",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T12:48:09.739906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T12:48:14.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "open-webui",
          "vendor": "open-webui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.6.31"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-15T21:15:08.055Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6"
        }
      ],
      "source": {
        "advisory": "GHSA-r29h-37fj-x2w6",
        "discovery": "UNKNOWN"
      },
      "title": "Open WebUI: Stored Cross-Site Scripting in SVG Renderer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45346",
    "datePublished": "2026-05-15T21:15:08.055Z",
    "dateReserved": "2026-05-11T21:40:08.177Z",
    "dateUpdated": "2026-05-18T12:48:14.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-R29H-37FJ-X2W6

Summary

Details

PoC

Impact

CVE-2026-45346 (GCVE-0-2026-45346)

Tags

Sightings

Nomenclature