Skip to main content
cve.nowby Sazabi
← npm
npmPackage

open-webui

7 known vulnerabilities (6 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 6 high, 1 medium
Weekly downloads
99
Dependents
0
Registry
npm

Advisories 7

  • Open WebUI: Stored XSS in Banner Component via Improper Sanitization Order

    Affected: fixed in 0.8.0.

  • CVE-2026-45346Medium 5.1

    Open WebUI: Stored Cross-Site Scripting in SVG Renderer

    Affected: fixed in 0.6.31.

  • Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution

    Affected: fixed in 0.9.5.

  • Open WebUI: Stored XSS via Model Description

    Affected: fixed in 0.9.0.

  • Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'

    Affected: fixed in 0.6.37.

  • Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

    Affected: fixed in 0.6.35.

  • Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

    Affected: fixed in 0.6.35.