Threats affecting pkg:pypi/open-webui

Open WebUI versions prior to 0.7.0 are vulnerable to a stored cross-site scripting (XSS) attack via the iFrame in the citations model. This occurs because users can manually modify chat history to set the 'html' property in document metadata, causing the frontend to render untrusted HTML content inside an iFrame with insufficient sandboxing. The vulnerability allows execution of arbitrary JavaScript when the citation is previewed or viewed in a shared chat. Exploitation requires the victim to expand the sources and click the malicious document. This can lead to session token theft for low-privilege users and potential remote code execution (RCE) risks for admins when combined with another vulnerability. No official patch or fix is currently documented.

An authenticated user with access to a terminal server in open-webui can exploit a path traversal and SSRF vulnerability via crafted encoded path segments. The vulnerability arises because the terminal-server reverse proxy does not fully sanitize user-controlled path inputs before forwarding them, allowing traversal outside intended scopes. A double-encoding technique bypasses the existing sanitization, enabling access to unintended files or internal services. This affects open-webui versions prior to 0.9.6.

Open WebUI versions prior to 0.9.0 contain a race condition in the LDAP and OAuth authentication flows that allows multiple concurrent first-user logins to be assigned the admin role. This occurs because the role assignment checks if any users exist before inserting the new user, creating a time-of-check-time-of-use (TOCTOU) race window. The signup handler was patched to prevent this, but LDAP and OAuth paths were not fixed until version 0.9.0. Exploiting this flaw enables multiple users to gain administrator privileges simultaneously on a fresh instance.