Executive brief
Open WebUI, a user interface for large language models, is vulnerable to a security flaw in how it displays charts. An attacker can create a malicious chart that, when viewed by another user, forces that user's browser to make unauthorized requests to internal or external websites. This could allow an attacker to scan internal networks or potentially read sensitive data from other services the victim has access to.
Technical details
Open WebUI fails to use a restricted resource loader when rendering 'vega' and 'vega-lite' fenced code blocks in chat content. The vulnerability exists in 'renderVegaVisualization' within 'src/lib/utils/index.ts' and 'CodeBlock.svelte'. An attacker with the ability to post content (via shared chats, channels, or RAG output) can embed a malicious Vega spec using 'data.url' or image marks. When a victim views the message, their browser executes outbound GET requests to attacker-specified targets. If the target is same-origin or has permissive CORS headers, the response can be read back into the rendered page. This bypasses server-side SSRF protections as the request originates from the client's browser. The issue is fixed in version 0.11.0 by implementing a restricted loader that only permits 'data:' URIs and same-origin results.
Affected products
- Open WebUI open-webui >= 0.6.34, < 0.11.0
Timeline
- 2026-08-02: patched: Fix released in version 0.11.0
- 2026-08-04: advisory: GitHub Advisory GHSA-rffm-9q57-q649 published