Executive brief
Open WebUI, an interface for interacting with large language models, is vulnerable to a security flaw where malicious code can be hidden within profile images. An attacker can upload a specially crafted image file that, when viewed by another user, executes malicious scripts in their browser. This could allow the attacker to steal login sessions, access sensitive API keys, or perform actions on behalf of the victim.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Open WebUI's channel webhook profile image handling. The application allows users to provide arbitrary 'profile_image_url' values, including base64-encoded SVG data. The server decodes this data and serves it with a 'Content-Disposition: inline' header and 'image/svg+xml' media type without performing any sanitization. An attacker with low-level privileges can create a webhook with a malicious SVG containing JavaScript event handlers (e.g., 'onload'). When an authenticated victim views the resulting image URL, the script executes in the application's origin, potentially leading to session hijacking or unauthorized API access. This issue is fixed in version 0.9.3.
Affected products
- Open WebUI open-webui <= 0.9.2
Timeline
- 2026-05-09: disclosed: Initial disclosure by Aikido Security
- 2026-05-09: patched: Version 0.9.3 released
- 2026-05-14: advisory: GitHub Advisory published
References
- https://api.github.com/users/Aikido-Security
- https://github.com/Aikido-Security
- https://api.github.com/users/Aikido-Security/gists%7B/gist_id%7D
- https://api.github.com/users/Aikido-Security/repos
- https://avatars.githubusercontent.com/u/240550485?v=4
- https://api.github.com/users/Aikido-Security/events%7B/privacy%7D