GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-3VV5-8XXP-4F55

Vulnerability from github – Published: 2026-06-17 14:10 – Updated: 2026-07-20 21:03
VLAI
Summary
Open WebUI: Cross-origin postMessage confirmation bypass via action:submit
Details

Summary

The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt() in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized POST /api/v1/chats/new and POST /api/chat/completions requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent.

Details

The chat page's window message listener in src/lib/components/chat/Chat.svelte processes message types including input:prompt and action:submit without adequately enforcing same-origin restrictions. Based on code around lines ~597-616, input text is set directly from event.data.text; action:submit proceeds to submitPrompt() on the current prompt. The logic does not apply a strict origin allowlist and permits non-same-origin control of the chat input and submission flow, leading to cross-origin command execution in the victim's authenticated UI context. As a result, backend API calls (e.g., POST /api/v1/chats/new, POST /api/chat/completions) are sent under victim credentials.

Normally, via the input:prompt:submit postMessage type, this results in a "Confirm Prompt from Embed" confirmation dialog:

https://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L604-L622

However, combining the two other types, it is possible to achieve the same effect without this confirmation:

https://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L584-L602

PoC

  1. Set up a local Open WebUI instance and log in to it, making sure a model is configured
  2. Host the following HTML anywhere and visit it (optionally change http://127.0.0.1:14000 to your instance Base URL):
<h1>Click anywhere</h1>
<script>
  function sleep(ms) {
    return new Promise(r => setTimeout(r, ms));
  }

  onclick = async () => {
    w = window.open('http://127.0.0.1:14000');
    await sleep(2000);
    w.postMessage({ type: 'input:prompt', text: "INJECTED PROMPT" }, '*');
    await sleep(500);
    w.postMessage({ type: 'action:submit' }, '*');
  }
</script>
  1. Click anywhere on the page, then notice without further interaction the "INJECTED PROMPT" is executed on the Open WebUI instance

image

Impact

Conditions required: The victim must be authenticated to Open WebUI in the browser (token cookie present).

This issue enables cross-site forced actions under the victim's identity. An attacker can silently inject prompts and trigger model/tool execution (e.g., code interpreter, web search, retrieval, terminal/tool servers) as the victim without confirmation.

Original Agent Report

app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20439940 (4)

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.9.5"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-346"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T14:10:35Z",
    "nvd_published_at": "2026-06-23T18:18:05Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe chat message listener allows non-same-origin `input:prompt` and `action:submit` messages, so an external site can set prompt text and trigger `submitPrompt()` in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized `POST /api/v1/chats/new` and `POST /api/chat/completions` requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent.\n\n### Details\n\nThe chat page\u0027s window message listener in `src/lib/components/chat/Chat.svelte` processes message types including `input:prompt` and `action:submit` without adequately enforcing same-origin restrictions. Based on code around lines ~597-616, input text is set directly from `event.data.text`; `action:submit` proceeds to `submitPrompt()` on the current prompt. The logic does not apply a strict origin allowlist and permits non-same-origin control of the chat input and submission flow, leading to cross-origin command execution in the victim\u0027s authenticated UI context. As a result, backend API calls (e.g., `POST /api/v1/chats/new`, `POST /api/chat/completions`) are sent under victim credentials.\n\nNormally, via the `input:prompt:submit` postMessage type, this results in a \"Confirm Prompt from Embed\" confirmation dialog:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L604-L622\n\nHowever, combining the two other types, it is possible to achieve the same effect without this confirmation:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L584-L602\n\n### PoC\n\n1. Set up a local Open WebUI instance and log in to it, making sure a model is configured\n2. Host the following HTML anywhere and visit it (optionally change http://127.0.0.1:14000 to your instance Base URL):\n\n```html\n\u003ch1\u003eClick anywhere\u003c/h1\u003e\n\u003cscript\u003e\n  function sleep(ms) {\n    return new Promise(r =\u003e setTimeout(r, ms));\n  }\n  \n  onclick = async () =\u003e {\n    w = window.open(\u0027http://127.0.0.1:14000\u0027);\n    await sleep(2000);\n    w.postMessage({ type: \u0027input:prompt\u0027, text: \"INJECTED PROMPT\" }, \u0027*\u0027);\n    await sleep(500);\n    w.postMessage({ type: \u0027action:submit\u0027 }, \u0027*\u0027);\n  }\n\u003c/script\u003e\n```\n\n3. Click anywhere on the page, then notice without further interaction the \"INJECTED PROMPT\" is executed on the Open WebUI instance\n\n\u003cimg width=\"874\" height=\"264\" alt=\"image\" src=\"https://github.com/user-attachments/assets/244d9015-0dbf-47e0-a30e-1c2fbbde5e58\" /\u003e\n\n### Impact\n\nConditions required: The victim must be authenticated to Open WebUI in the browser (token cookie present).\n\nThis issue enables cross-site forced actions under the victim\u0027s identity. An attacker can silently inject prompts and trigger model/tool execution (e.g., code interpreter, web search, retrieval, terminal/tool servers) as the victim without confirmation.\n\n### Original Agent Report\n\n\u003cimg width=\"400\" alt=\"app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20439940 (4)\" src=\"https://github.com/user-attachments/assets/7b6521ed-d08b-446d-a918-103523d08a1e\" /\u003e",
  "id": "GHSA-3vv5-8xxp-4f55",
  "modified": "2026-07-20T21:03:30Z",
  "published": "2026-06-17T14:10:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3vv5-8xxp-4f55"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54007"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-3vv5-8xxp-4f55"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/open-webui/PYSEC-2026-2695.yaml"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Open WebUI: Cross-origin postMessage confirmation bypass via action:submit"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.