MediumVulnerability
GHSA-r29h-37fj-x2w6: Open WebUI Has Stored Cross-Site Scripting in SVG Renderer
- Identifiers
- CVE-2026-45346GHSA-r29h-37fj-x2w6
- Published
- Record updated
- Affected
- open-webui < 0.6.31
- Fixed in
- 0.6.31
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
A stored cross-site scripting flaw exists in the SVG renderer of Open WebUI, tracked as GHSA-r29h-37fj-x2w6. An authenticated user can edit a generated SVG and append an img element with an onerror handler, and the code runs when the image is saved and rendered. The malicious thread can be shared with other users or administrators, which the report says can expose sensitive data or lead to account takeover.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumGitLab critical patches include one for a bug that allows code execution by unauthenticated usersSimilar attack · CSO Online
- HighCVE-2026-115419 - Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerSimilar attack · AWS Security Bulletins
- CriticalCVE-2026-114612: LiteLLM admin access via forged credential replay enables MCP stdio commandsSimilar attack · NVD/CVE Database
- LowThird-party evaluators found vulnerabilities in OpenAI monitoring system during test pilotSimilar attack · CNBC Technology
- InfoSomeone hacked the Switch 2 by using an old game and AISimilar attack · The Verge (AI)