p PatchFirst

CVE-2026-45346

CVE-2026-45346 · Open WebUI: Stored Cross-Site Scripting in SVG Renderer

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31.

CVSS 5.1 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • open-webui

    Versions
    • < 0.6.31: Affected

    No fix published

  • open-webui npm

    Affected ranges
    • SEMVER: < 0.6.31

    Update to 0.6.31

Original sources

Check your server →