Security
فارسی
All products

open-webui

npm · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
open-webui Vulnerable to Stored XSS via Model DescriptionCVE-2026-44721 · GHSA-GF5M-WCRH-7928Version ranges need review. open-webuiopen-webui npmPyPI High Fix reported
Open WebUI Uncontrolled Resource Consumption vulnerabilityCVE-2024-12534 · GHSA-G3MX-83MP-3RWCVersion ranges need review. open-webuiopen-webui npmPyPI High No fix reported
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE EventsCVE-2025-64496 · GHSA-CM35-V4VP-5XVXVersion ranges need review. open-webuiopen-webui npmPyPI High Fix reported
Open WebUI Uncontrolled Resource Consumption vulnerabilityCVE-2024-12537 · GHSA-CHF7-Q7M5-FQ92Version ranges need review. open-webuiopen-webui npmPyPI High No fix reported
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCECVE-2025-64495 · GHSA-W7XJ-8FX7-WFCHVersion ranges need review. open-webuiopen-webui npmPyPI High Fix reported
Open WebUI has Stored XSS in Banner Component via Improper Sanitization OrderCVE-2026-45665 · GHSA-CQP4-QQVG-3787 open-webui npm High Fix reported
Open WebUI Has Stored Cross-Site Scripting in SVG RendererCVE-2026-45346 · GHSA-R29H-37FJ-X2W6 open-webui npm Medium Fix reported
Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code ExecutionCVE-2026-45395 · GHSA-P4FX-23FQ-JFG6 open-webui npm High Fix reported
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'CVE-2025-65959 · GHSA-8WVC-869R-XFQF open-webui npm High Fix reported
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) VulnerabilityGHSA-5CCF-884P-4JJQ open-webuiopen-webui npmPyPI High No fix reported