Open WebUI Stored XSS via OAuth SVG Data URI

github.com 2026-07-15查看中文 →

Security AdvisoryHighOpen WebUI

Affected:

Open WebUI <= 0.9.4

Fixed in:

Open WebUI >= 0.9.5

Referenced CVEs: CVE-2026-56398 · 7.3

文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive

This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.

More from this source

FlowiseAI SSRF via Incomplete Deny-List to Cloud Metadata (CVE-2026-67620) 2026-08-09 Path Traversal Arbitrary File Write in astralisone/rive-mcp-server-core 2026-08-08 @mindpilot/mcp 0.5.0 Path Traversal Vulnerability and POC 2026-08-08 Path Traversal in memory-graph allowing arbitrary file read/write with PoC 2026-08-08 Command Injection in MauricioMilano/coder-api Project Creation via Git Clone Parameters 2026-08-08

Offline Archive

Offline screenshot & PDF are Pro-exclusive