https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for open-webui/open-webui en-us Tue, 01 Sep 2026 14:23:07 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/613 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/613 Tue, 25 Aug 2026 22:07:57 GMT The PortPreview iframe previously included 'allow-same-origin' by default (terminalPreviewAllowSameOrigin default true). Because the iframe src is a same-origin proxy URL, arbitrary HTML/JavaScript served on the previewed port could execute in the same origin as Open WebUI, allowing it to access parent cookies/localStorage and exfiltrate the user's session. The patch changes the default to false, removing 'allow-same-origin' from the sandbox and isolating the iframe's origin. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/605 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/605 Tue, 25 Aug 2026 21:22:29 GMT Before the patch, the terminal port preview iframe sandbox defaulted to including `allow-same-origin` together with `allow-scripts`. This combination effectively disables the sandbox for same-origin content, allowing untrusted content served through the terminal port proxy to access the parent Open WebUI origin and exfiltrate session tokens or perform actions as the victim. The patch changes the default to `false`, ensuring the iframe sandbox no longer grants same-origin access by default. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/614 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/614 Tue, 25 Aug 2026 22:12:55 GMT The default value for RAG_METADATA_MAX_VALUE_CHARS was None, meaning document metadata extracted from uploaded files had no size limit. An attacker could upload a small crafted Office document (zip bomb) that expands to gigabytes of metadata during extraction, exhausting server memory and causing a denial of service. The patch falls back to the configured upload size limit (RAG_FILE_MAX_SIZE) when no explicit metadata limit is set. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/606 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/606 Tue, 25 Aug 2026 21:26:51 GMT Before the patch, if RAG_METADATA_MAX_VALUE_CHARS was not explicitly set, extracted document metadata was allowed to be unbounded in size. A crafted Office document (zip archive) could expand from a few hundred kilobytes to gigabytes of metadata during extraction, causing memory exhaustion and denial of service. The patch defaults the metadata limit to the configured RAG_FILE_MAX_SIZE (in MB) when the explicit metadata limit is absent. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/607 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/607 Tue, 25 Aug 2026 21:28:32 GMT Before the patch, the code interpreter tag detector ran regardless of the tool-calling mode. In native (agentic) mode, a model that emitted a `<code_interpreter>` block in its reply text—whether due to prompt injection or unintended output—had the contained Python code executed on the server. The patch restricts tag detection to legacy tool-calling mode only, preventing execution of code from ordinary model responses. critical verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/615 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/615 Tue, 25 Aug 2026 22:17:13 GMT The code before the patch failed to verify user access to the fallback model when a custom model's base model was missing and ENABLE_CUSTOM_MODEL_FALLBACK was enabled. An attacker with permission to use a custom model could set its base_model_id to a non-existent model to trigger fallback to the admin-configured default model, bypassing model-level access controls. The patch adds an explicit check_model_access call for the fallback model. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/608 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/608 Tue, 25 Aug 2026 21:34:08 GMT The original code checked model access only for the requested custom model before potentially replacing it with a fallback model when the custom model's base model was missing. A user with access to the custom model but not the fallback model could trigger the fallback and use an unauthorized model. The patch adds an explicit access-control check on the fallback model, preventing this privilege escalation. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/616 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/616 Tue, 25 Aug 2026 22:23:13 GMT Before the patch, SSRF protections were only applied during initial URL validation and DNS resolution. Redirect targets were not revalidated, and aiohttp handles IP-literal hosts directly without consulting the DNS resolver, so a submitted public URL could redirect to 169.254.169.254 or other internal/cloud metadata addresses when AIOHTTP_CLIENT_ALLOW_REDIRECTS=true. The response body would be returned to the caller, leaking cloud credentials or internal service data. The patch adds per-request and per-connection checks that validate every hop, including redirects and IP-literal connections. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/609 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/609 Tue, 25 Aug 2026 21:42:04 GMT The pre-patch code validated only the originally submitted URL and, on aiohttp paths, only checked DNS-resolved addresses. Redirects to IP literals such as 169.254.169.254 bypassed both the private-IP check and WEB_FETCH_FILTER_LIST, allowing an attacker to make the server fetch internal/cloud-metadata endpoints and return their contents when redirects are enabled. The patch moves the checks into per-request connection hooks that run on every hop, including redirects. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/610 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/610 Tue, 25 Aug 2026 21:46:38 GMT Before the patch, an authenticated user with model creation or update permissions could set a model's base_model_id to its own id. During model retrieval or chat completion, the application recursively resolves base model parameters, causing infinite recursion and a denial of service (500 errors) for any user interacting with that model. The patch ensures base_model_id is never set to the model's own id by nullifying it. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/617 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/617 Tue, 25 Aug 2026 22:27:42 GMT Before the patch, archive-based document uploads (.docx, .xlsx, .pptx, .odt, .epub) were passed directly to extraction loaders without validating decompressed size. An authenticated user could upload a small compressed zip bomb that expands to gigabytes, exhausting server memory/disk and causing a denial of service. The patch inspects the ZIP central directory and rejects archives whose uncompressed size exceeds a computed limit. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/611 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/611 Tue, 25 Aug 2026 21:48:09 GMT Before the patch, the document loader did not validate the uncompressed size of archive-based file formats such as DOCX, XLSX, PPTX, EPUB, and ODT. An attacker could upload a small compressed file that expands to many gigabytes, causing memory or disk exhaustion and denial of service. The patch adds an uncompressed size check and raises ValueError if the expanded content exceeds the configured maximum file size. medium verified