CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability
Summary
CVE-2024-6706: Open WebUI Stored Cross-Site Scripting Vulnerability. Affects open-webui versions < 0.1.105. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a Python package available on PyPI that provides a user-friendly interface for web applications. It allows developers to create interactive web applications with ease. However, it has been identified to have a critical vulnerability that exposes users to potential attacks through malicious scripts.
Vulnerability Detail
The vulnerability arises from the ability of attackers to craft a malicious prompt that can manipulate the language model into executing arbitrary JavaScript within the context of the web page. This stored cross-site scripting (XSS) vulnerability can lead to unauthorized actions being performed on behalf of the user, data theft, and other malicious activities. The vulnerability affects versions up to 0.1.105, making it crucial for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize user inputs and outputs to prevent the execution of malicious scripts. Implementing a Content Security Policy (CSP) can also help mitigate the risk of XSS attacks.
Conclusion
The Open WebUI package has a critical stored cross-site scripting vulnerability that can lead to severe security risks. Users are advised to update their packages to the latest version to mitigate these risks and ensure the safety of their applications.
See every vulnerability recorded for open-webui →
FAQ
The vulnerability is a stored cross-site scripting (XSS) issue that allows attackers to execute arbitrary JavaScript on the affected web pages.
Versions of Open WebUI up to 0.1.105 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include unauthorized actions performed on behalf of users, data theft, and the execution of malicious scripts.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
