CVE-2026-45346: Open WebUI SVG Renderer XSS Vulnerability

CVE-2026-45346 Overview

CVE-2026-45346 is a Cross-Site Scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw resides in the SVG renderer implementation and affects all versions prior to 0.6.31. An authenticated attacker can craft malicious Scalable Vector Graphics (SVG) content that executes script in another user's browser session. The issue is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page and was addressed in Open WebUI version 0.6.31.

Critical Impact
Authenticated attackers can inject scripts via the SVG renderer, enabling session compromise, AI prompt manipulation, or theft of sensitive data rendered in the Open WebUI interface.

Affected Products

Open WebUI versions prior to 0.6.31
Self-hosted Open WebUI deployments exposing the SVG rendering feature
Multi-user Open WebUI instances where user-supplied or model-generated content is rendered

Discovery Timeline

2026-05-15 - CVE-2026-45346 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45346

Vulnerability Analysis

The vulnerability exists in how Open WebUI processes and renders SVG content within the chat interface. SVG is an XML-based image format that natively supports embedded <script> tags, event handlers such as onload and onclick, and <foreignObject> elements containing HTML. When the application renders untrusted SVG markup without proper sanitization, the embedded code executes in the context of the authenticated user's browser session.

In an AI chat platform, SVG payloads can originate from multiple sources. These include user-uploaded files, content generated by language models in response to crafted prompts, and shared chats or workspaces. Each of these channels can become a delivery vector when the renderer trusts the SVG content.

Successful exploitation allows the attacker to execute arbitrary JavaScript under the victim's origin. This enables theft of session tokens, manipulation of API requests to the underlying language model, exfiltration of conversation history, and modification of model configuration accessible to the victim.

Root Cause

The root cause is improper neutralization of script-related HTML tags inside SVG content rendered by the Open WebUI front end. SVG documents are treated as inline markup rather than sandboxed images, so script vectors are preserved through to the Document Object Model (DOM). The renderer lacks a strict allowlist of safe SVG elements and attributes.

Attack Vector

Exploitation requires network access to the Open WebUI instance and low-privileged authenticated access. The attacker submits SVG markup containing script payloads through any feature that ultimately renders SVG in another user's browser. User interaction is required, since the victim must view the content. Refer to the GitHub Security Advisory GHSA-r29h-37fj-x2w6 for vendor-confirmed details.

Detection Methods for CVE-2026-45346

Indicators of Compromise

SVG files or inline SVG markup containing <script>, onload=, onerror=, or <foreignObject> elements stored in Open WebUI chat history or uploads.
Unexpected outbound HTTP requests from browser sessions of Open WebUI users to attacker-controlled domains.
Open WebUI session tokens or API keys appearing in web server logs of unrelated external hosts.

Detection Strategies

Inspect stored chat content and uploaded assets for SVG payloads containing executable script constructs.
Review Open WebUI access logs for repeated rendering of identical SVG resources across multiple user sessions.
Deploy Content Security Policy (CSP) violation reporting and triage script-src and inline-script violations originating from the Open WebUI origin.

Monitoring Recommendations

Monitor the Open WebUI version banner and confirm all instances report 0.6.31 or later.
Alert on browser-side JavaScript errors and CSP reports correlated with chat rendering endpoints.
Track network egress from workstations that access Open WebUI to identify anomalous destinations indicative of token exfiltration.

How to Mitigate CVE-2026-45346

Immediate Actions Required

Upgrade all Open WebUI deployments to version 0.6.31 or later as published in the vendor advisory.
Audit existing chat history, shared workspaces, and uploaded files for SVG content submitted before the patch was applied.
Rotate session secrets and API keys for any Open WebUI account that may have viewed untrusted SVG content.

Patch Information

The maintainers fixed the SVG renderer in Open WebUI 0.6.31. The fix and remediation guidance are documented in the Open WebUI GHSA-r29h-37fj-x2w6 advisory. Apply the upgrade through the standard container image or pip package distribution path used by your deployment.

Workarounds

Disable or restrict SVG rendering features in Open WebUI until the patched version can be deployed.
Place Open WebUI behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts on the application origin.
Limit account creation and require authenticated, trusted users only, reducing the pool of accounts that can submit malicious SVG content.

bash

# Configuration example: upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.6.31
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.6.31