CVE Vulnerability Catalog

Open WebUI versions 0.9.6 through 0.11.0 have a DoS vulnerability in the knowledge search path. Patterns containing regex metacharacters are compiled with Python's backtracking re engine and run without time limit, allowing an attacker to pin a CPU core and block the event loop. The issue is fixed in version 0.11.0.

In Open WebUI version 0.10.2 and earlier, the GET /api/v1/tools/, GET /api/v1/tools/list, and GET /api/v1/tools/id/{id} endpoints returned full Python tool source to authenticated non-admin read-only users. ToolResponse deliberately omitted source and specs, but ToolUserResponse permitted extra fields and handlers spread a full tool model dump into the response, re-admitting omitted fields.

Open WebUI from 0.8.8 to 0.11.0 has a vulnerability in the terminal WebSocket route that authenticates its own first-message JWT and never applies the verified-user role gate. An account with pending role, including unapproved or deactivated accounts, can open an interactive terminal session when at least one terminal server is configured. Fixed in 0.11.0.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, automation recurrence parsing in backend/open_webui/utils/automations.py anchored minutely and hourly rules at a fixed date of 2000-01-01 and then walked forward one interval at a time to find the next run. A single FREQ=MINUTELY rule enumerates roughly a quarter-century of occurrences synchronously on the event loop that also serves scheduler, HTTP, and WebSocket traffic, and the scheduler recomputes the next run for every claimed row on each poll. This causes availability impact for every other user of the instance. This issue is fixed in 0.11.0.

Open WebUI from 0.9.6 to 0.11.0 has a vulnerability in the sync cleanup endpoint that authorizes write access to a knowledge base in the URL but acts on directory and file ids from the request body without checking ownership. A user with write access to one knowledge base can delete directories and remove file embeddings from another knowledge base. Fixed in 0.11.0.

Open WebUI from 0.8.8 until 0.11.0 accepts client-supplied knowledge attachments without filtering them against the caller's read access. Any authenticated user who knew another user's file id could have the builtin knowledge tools return indexed chunks from that file, causing a read-only cross-user confidentiality loss. This issue is fixed in 0.11.0.

Open WebUI prior to 0.11.0 resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but HTTP clients resolved the hostname again at connection time. An authenticated attacker controlling DNS could answer with a public address during validation and an internal one during connection, reaching internal services or cloud metadata, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. Fixed in 0.11.0.

Open WebUI from version 0.7.0 to 0.11.0 contains a vulnerability where the legacy chat-completions feature ignores the client-supplied image_generation flag and fails to re-check the image_generation permission. An authenticated user with revoked image-generation permission can still consume the configured image provider through chat completions.

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete handlers accepted any caller holding write access on the channel without checking that the caller wrote the message. Because write access is the same grant a member needs to post, any ordinary participant in a shared standard channel could rewrite or permanently delete another participant message, while group and direct message handlers enforced authorship. This issue is fixed in 0.11.0.

Open WebUI from 0.6.34 to 0.11.0 renders vega and vega-lite fenced code blocks in chat content by building a Vega view without a restricted resource loader. A user who can place such a block can make another user's browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets.

Flowise prior to 3.1.3 has a vulnerability in the PUT /api/v1/executions/:id endpoint, which lacks the checkAnyPermission() middleware that protects other execution endpoints. Any authenticated user, regardless of assigned permissions, can modify execution state, data, and metadata of any execution in their workspace, enabling privilege escalation and manipulation of workflow execution results.

GoRest is a Golang starter kit built with the Gin framework. In versions prior to 1.12.2, nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers concurrently read and write to this map, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand.

An improper certificate validation vulnerability in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances.

Flowise prior to 3.1.3 injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. A user or API key denied variables:view can call /api/v1/node-custom-function and receive all workspace variables, including secrets.

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp() deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized database operations including data deletion and extraction.

SnailJob 1.7.0 has a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field. This causes unbounded array allocation and an OutOfMemoryError.

A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service.

SNOMED International Snowstorm contains a reflected XSS vulnerability within the 'Web Route' redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3.

pdm, a Python package and dependency manager, prior to version 2.27.0 writes several project-local state or configuration files without symlink protection. A malicious repository can place those files as symlinks, and local PDM operations can overwrite the symlink targets, creating an arbitrary file clobber primitive relative to the invoking user's privileges.

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successful exploit of this vulnerability might lead to information disclosure.