CVE-2026-54013: Open WebUI SVG XSS Vulnerability

CVE-2026-54013 Overview

CVE-2026-54013 is a stored cross-site scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to run offline. Versions prior to 0.9.6 fail to validate model profile image uploads, allowing authenticated users to store malicious SVG payloads. The ModelMeta class lacks a validate_profile_image_url field validator, and the model image serving endpoint enforces no MIME allowlist or X-Content-Type-Options: nosniff header. Any user with the default workspace.models permission can embed a data:image/svg+xml;base64,... payload and trigger script execution in another user's browser session. The flaw is tracked under CWE-79.

Critical Impact
An authenticated low-privilege attacker can achieve full account takeover of any user who views a malicious model profile image.

Affected Products

Open WebUI versions prior to 0.9.6
Deployments where the default workspace.models permission is enabled
Self-hosted Open WebUI instances exposing the model image serving endpoint

Discovery Timeline

2026-06-23 - CVE-2026-54013 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54013

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Open WebUI's model profile image handling. Open WebUI previously patched SVG-based XSS in user profile images and webhook profile images. The same hardening was never applied to model profile images. The ModelMeta class accepts arbitrary profile_image_url values without sanitization or scheme validation. An attacker submits a data:image/svg+xml;base64,<payload> URI containing JavaScript inside <script> tags or event handlers. When a victim navigates to the model image URL, the browser renders the SVG and executes the embedded script in the application origin. The attacker can then exfiltrate session tokens, perform API calls as the victim, or pivot to administrative accounts.

Root Cause

The root cause is missing input validation in the ModelMeta Pydantic model combined with insecure response headers. The model image serving endpoint returns user-supplied content without a MIME type allowlist and without the X-Content-Type-Options: nosniff header. Browsers content-sniff the response and execute SVG payloads as active content within the application's same-origin context.

Attack Vector

Exploitation requires an authenticated account with the workspace.models permission, which is granted to all users by default. The attacker creates or edits a model and sets the profile image to a crafted base64-encoded SVG containing JavaScript. The attacker then shares or surfaces the model so other users browse to its image URL. User interaction is required to trigger script execution, after which the attacker can hijack the victim's session and take over the account. Refer to the GitHub Security Advisory GHSA-v2qm-5wxj-qhj7 for additional technical context.

Detection Methods for CVE-2026-54013

Indicators of Compromise

Model records containing profile_image_url values that begin with data:image/svg+xml or other non-image MIME schemes
HTTP responses from the model image endpoint returning SVG content without a Content-Type: image/png or image/jpeg header
Unexpected outbound requests from authenticated user sessions to attacker-controlled domains following model image views
Audit log entries showing model creation or update events from low-privilege accounts with unusually large profile_image_url payloads

Detection Strategies

Inspect the Open WebUI database for models rows whose meta.profile_image_url field contains script, onload, onerror, or javascript: substrings
Deploy a Content Security Policy (CSP) report-only header and review reports for inline script violations originating from the model image route
Correlate workspace model modifications with subsequent authentication anomalies such as new API keys, session token reuse, or privilege changes

Monitoring Recommendations

Enable verbose application logging on the /api/v1/models endpoint and forward to a centralized SIEM for analysis
Alert on creation of model records by accounts that have never previously interacted with the workspace models feature
Monitor for repeated requests to the same model image URL from multiple distinct user sessions in a short window

How to Mitigate CVE-2026-54013

Immediate Actions Required

Upgrade Open WebUI to version 0.9.6 or later, which adds the missing validate_profile_image_url field validator and serving-side hardening
Audit existing model records and remove any profile_image_url values that use the data: URI scheme or contain SVG content
Revoke active sessions and rotate API tokens for any user account suspected of viewing a malicious model image

Patch Information

The vendor fixed CVE-2026-54013 in Open WebUI 0.9.6. The patch applies the same SVG validation logic that previously protected user and webhook profile images to the ModelMeta class and adds MIME enforcement and a nosniff header on the image serving endpoint. Patch details are published in the Open WebUI security advisory GHSA-v2qm-5wxj-qhj7.

Workarounds

Disable the default workspace.models permission for non-administrative users until the upgrade is applied
Deploy a reverse-proxy rule that strips or rewrites responses from the model image endpoint when the Content-Type is not an allowlisted raster image format
Enforce a strict Content Security Policy that disallows inline scripts and restricts image sources to the application origin

bash

# Upgrade Open WebUI to the patched release
pip install --upgrade open-webui>=0.9.6

# Or, for Docker deployments
docker pull ghcr.io/open-webui/open-webui:0.9.6
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui ghcr.io/open-webui/open-webui:0.9.6