Executive brief
Open WebUI is a self-hosted interface for interacting with artificial intelligence models. A security flaw allows malicious websites to silently send commands and prompts to a user's Open WebUI session if they are logged in. This could allow an attacker to force the AI to perform actions, such as running code or searching the web, using the victim's account and permissions without their knowledge.
Technical details
A vulnerability exists in the chat message listener within `src/lib/components/chat/Chat.svelte` due to insufficient origin validation of `postMessage` events. While the `input:prompt:submit` message type correctly triggers a confirmation dialog for cross-origin requests, an attacker can bypass this by chaining `input:prompt` and `action:submit` messages. By hosting a malicious page that opens a window to the Open WebUI instance and sends these messages, an attacker can force the victim's browser to execute unauthorized `POST /api/v1/chats/new` and `POST /api/chat/completions` requests. This allows for arbitrary model or tool execution under the victim's privileges. The issue is fixed in version 0.9.6.
Affected products
- Open WebUI Open WebUI < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub Security Advisory published
- 2026-06-23: disclosed: NVD publication date
- 2026-06-23: patched: Fix confirmed in version 0.9.6