LLM frameworks · Open WebUI
Open WebUI
Self-hosted chat UI for Ollama and OpenAI-compatible APIs.
3Advisories
0critical
3high
0medium
2026-09-10Latest
Timeline · advisories per quarter
12026 Q2
22026 Q3
Named in sources
Reported for Open WebUI
01. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 02. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 03. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14
Open WebUI 2026-09-10 02. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 03. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14