CVE-2026-45314: Open WebUI XSS Vulnerability

CVE-2026-45314 Overview

CVE-2026-45314 is a stored Cross-Site Scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw exists in the channel webhook create and update flow, which accepts arbitrary profile_image_url values, including data:image/svg+xml;base64,... payloads. The profile image endpoint decodes and serves the SVG with the image/svg+xml content type without sanitization. Attacker-controlled script handlers such as onload execute when a victim opens the profile-image URL in a browser. The issue affects all versions prior to 0.9.3 and is tracked as [CWE-87] (Improper Neutralization of Alternate XSS Syntax).

Critical Impact
Authenticated low-privilege users can inject persistent JavaScript that runs in any browser session that loads the channel webhook's profile image, enabling session theft and account takeover.

Affected Products

Open WebUI versions prior to 0.9.3
Self-hosted Open WebUI deployments exposing channel webhook functionality
Multi-user Open WebUI instances where webhook profile images are rendered to other users

Discovery Timeline

2026-05-15 - CVE-2026-45314 published to the National Vulnerability Database (NVD)
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45314

Vulnerability Analysis

The vulnerability resides in the channel webhook create/update handler in Open WebUI. The endpoint accepts a user-supplied profile_image_url field with no scheme allow-list or content validation. When the value is a data: URI carrying base64-encoded SVG markup, the server decodes the payload and serves it back through the profile image route with the Content-Type: image/svg+xml response header.

Browsers treat SVG documents as active content. Any <script> element or event handler attribute such as onload, onerror, or onclick inside the SVG executes in the security context of the Open WebUI origin. An attacker with the ability to create or update a channel webhook can therefore plant persistent script that runs whenever another user opens the webhook profile image, including via inline previews in chat channels.

Root Cause

The root cause is missing input validation on the profile_image_url parameter combined with unsanitized output of decoded SVG content. The endpoint trusts the supplied data URI, decodes the base64 payload, and serves it with a script-capable MIME type. There is no SVG sanitizer, no Content Security Policy restriction, and no enforcement that profile images must reference safe raster formats.

Attack Vector

Exploitation requires network access to the Open WebUI instance and a low-privileged authenticated account permitted to create or update a channel webhook. The attacker submits a crafted webhook with profile_image_url set to a data:image/svg+xml;base64,... value containing an SVG with an onload handler. When a victim, including an administrator, views any UI surface that renders the webhook avatar or opens the profile image URL, the SVG executes attacker JavaScript under the Open WebUI origin. The script can exfiltrate session tokens, call privileged API endpoints, or pivot to administrative actions. User interaction is required, which is reflected in the attack complexity.

Detection Methods for CVE-2026-45314

Indicators of Compromise

Channel webhook records with profile_image_url values beginning with data:image/svg+xml or other non-https:// schemes.
HTTP responses from the profile image endpoint served with Content-Type: image/svg+xml containing <script> tags or on* event handler attributes.
Outbound requests from end-user browsers to attacker-controlled domains shortly after rendering channel webhook avatars.

Detection Strategies

Query the Open WebUI database for webhook rows where profile_image_url is not an HTTPS URL pointing to a trusted host, then inspect decoded payloads for SVG content.
Add web application firewall (WAF) rules that block POST and PATCH requests to the channel webhook endpoints when the body contains data:image/svg in the profile_image_url field.
Inspect proxy or reverse-proxy logs for responses from /api/v1/channels/* profile image routes with the image/svg+xml content type.

Monitoring Recommendations

Forward Open WebUI application logs and reverse-proxy access logs to a centralized SIEM and alert on SVG responses originating from profile image routes.
Monitor authenticated API activity for unusual webhook create/update sequences from non-administrator accounts.
Track browser-side errors and Content Security Policy reports for inline script violations on Open WebUI domains.

How to Mitigate CVE-2026-45314

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.9.3 or later, where the channel webhook profile image flow validates and sanitizes the supplied URL.
Audit existing channel webhooks and remove or reset any profile_image_url value that uses a data: URI or references untrusted hosts.
Rotate session tokens and API keys for users who may have viewed malicious webhook avatars before patching.

Patch Information

The vulnerability is fixed in Open WebUI 0.9.3. Refer to the Open WebUI GitHub Security Advisory GHSA-3856-3vxq-m6fc for the official advisory and patch details.

Workarounds

Restrict channel webhook creation and update permissions to trusted administrators until the upgrade is applied.
Place Open WebUI behind a reverse proxy that strips or rewrites Content-Type: image/svg+xml responses from profile image endpoints to image/png or application/octet-stream.
Deploy a strict Content Security Policy that disallows inline scripts and restricts img-src to trusted origins, reducing the impact of SVG-based XSS.

bash

# Example nginx configuration to block SVG responses from the profile image route
location ~ ^/api/v1/channels/.*/profile-image {
    proxy_pass http://open_webui_upstream;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/octet-stream" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; img-src 'self' data:" always;
}