{"data":{"id":"c20a4c42-169b-43a2-bffb-0863a4bfd895","title":"GHSA-r29h-37fj-x2w6: Open WebUI Has Stored Cross-Site Scripting in SVG Renderer","summary":"A stored cross-site scripting flaw exists in the SVG renderer of Open WebUI, tracked as GHSA-r29h-37fj-x2w6. An authenticated user can edit a generated SVG and append an img element with an onerror handler, and the code runs when the image is saved and rendered. The malicious thread can be shared with other users or administrators, which the report says can expose sensitive data or lead to account takeover.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-r29h-37fj-x2w6","publishedAt":"2026-05-14T20:21:51.000Z","cveId":"CVE-2026-45346","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["open-webui@< 0.6.31 (fixed: 0.6.31)"],"affectedPackageNames":["open-webui"],"affectedPackageRefs":["npm:open-webui"],"affectedVendors":[],"affectedVendorsRaw":["Open WebUI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00239,"epssCheckedAt":"2026-10-23T00:09:18.943Z","kevDateAdded":null,"advisoryAliases":["GHSA-r29h-37fj-x2w6"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T20:21:51.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}