GHSA-3VV5-8XXP-4F55
Vulnerability from github – Published: 2026-06-17 14:10 – Updated: 2026-06-17 14:10Summary
The chat message listener allows non-same-origin input:prompt and action:submit messages, so an external site can set prompt text and trigger submitPrompt() in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized POST /api/v1/chats/new and POST /api/chat/completions requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent.
Details
The chat page's window message listener in src/lib/components/chat/Chat.svelte processes message types including input:prompt and action:submit without adequately enforcing same-origin restrictions. Based on code around lines ~597-616, input text is set directly from event.data.text; action:submit proceeds to submitPrompt() on the current prompt. The logic does not apply a strict origin allowlist and permits non-same-origin control of the chat input and submission flow, leading to cross-origin command execution in the victim's authenticated UI context. As a result, backend API calls (e.g., POST /api/v1/chats/new, POST /api/chat/completions) are sent under victim credentials.
Normally, via the input:prompt:submit postMessage type, this results in a "Confirm Prompt from Embed" confirmation dialog:
https://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L604-L622
However, combining the two other types, it is possible to achieve the same effect without this confirmation:
https://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L584-L602
PoC
- Set up a local Open WebUI instance and log in to it, making sure a model is configured
- Host the following HTML anywhere and visit it (optionally change http://127.0.0.1:14000 to your instance Base URL):
<h1>Click anywhere</h1>
<script>
function sleep(ms) {
return new Promise(r => setTimeout(r, ms));
}
onclick = async () => {
w = window.open('http://127.0.0.1:14000');
await sleep(2000);
w.postMessage({ type: 'input:prompt', text: "INJECTED PROMPT" }, '*');
await sleep(500);
w.postMessage({ type: 'action:submit' }, '*');
}
</script>
- Click anywhere on the page, then notice without further interaction the "INJECTED PROMPT" is executed on the Open WebUI instance
Impact
Conditions required: The victim must be authenticated to Open WebUI in the browser (token cookie present).
This issue enables cross-site forced actions under the victim's identity. An attacker can silently inject prompts and trigger model/tool execution (e.g., code interpreter, web search, retrieval, terminal/tool servers) as the victim without confirmation.
Original Agent Report
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.5"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54007"
],
"database_specific": {
"cwe_ids": [
"CWE-346"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-17T14:10:35Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n\nThe chat message listener allows non-same-origin `input:prompt` and `action:submit` messages, so an external site can set prompt text and trigger `submitPrompt()` in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized `POST /api/v1/chats/new` and `POST /api/chat/completions` requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent.\n\n### Details\n\nThe chat page\u0027s window message listener in `src/lib/components/chat/Chat.svelte` processes message types including `input:prompt` and `action:submit` without adequately enforcing same-origin restrictions. Based on code around lines ~597-616, input text is set directly from `event.data.text`; `action:submit` proceeds to `submitPrompt()` on the current prompt. The logic does not apply a strict origin allowlist and permits non-same-origin control of the chat input and submission flow, leading to cross-origin command execution in the victim\u0027s authenticated UI context. As a result, backend API calls (e.g., `POST /api/v1/chats/new`, `POST /api/chat/completions`) are sent under victim credentials.\n\nNormally, via the `input:prompt:submit` postMessage type, this results in a \"Confirm Prompt from Embed\" confirmation dialog:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L604-L622\n\nHowever, combining the two other types, it is possible to achieve the same effect without this confirmation:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L584-L602\n\n### PoC\n\n1. Set up a local Open WebUI instance and log in to it, making sure a model is configured\n2. Host the following HTML anywhere and visit it (optionally change http://127.0.0.1:14000 to your instance Base URL):\n\n```html\n\u003ch1\u003eClick anywhere\u003c/h1\u003e\n\u003cscript\u003e\n function sleep(ms) {\n return new Promise(r =\u003e setTimeout(r, ms));\n }\n \n onclick = async () =\u003e {\n w = window.open(\u0027http://127.0.0.1:14000\u0027);\n await sleep(2000);\n w.postMessage({ type: \u0027input:prompt\u0027, text: \"INJECTED PROMPT\" }, \u0027*\u0027);\n await sleep(500);\n w.postMessage({ type: \u0027action:submit\u0027 }, \u0027*\u0027);\n }\n\u003c/script\u003e\n```\n\n3. Click anywhere on the page, then notice without further interaction the \"INJECTED PROMPT\" is executed on the Open WebUI instance\n\n\u003cimg width=\"874\" height=\"264\" alt=\"image\" src=\"https://github.com/user-attachments/assets/244d9015-0dbf-47e0-a30e-1c2fbbde5e58\" /\u003e\n\n### Impact\n\nConditions required: The victim must be authenticated to Open WebUI in the browser (token cookie present).\n\nThis issue enables cross-site forced actions under the victim\u0027s identity. An attacker can silently inject prompts and trigger model/tool execution (e.g., code interpreter, web search, retrieval, terminal/tool servers) as the victim without confirmation.\n\n### Original Agent Report\n\n\u003cimg width=\"400\" alt=\"app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20439940 (4)\" src=\"https://github.com/user-attachments/assets/7b6521ed-d08b-446d-a918-103523d08a1e\" /\u003e",
"id": "GHSA-3vv5-8xxp-4f55",
"modified": "2026-06-17T14:10:35Z",
"published": "2026-06-17T14:10:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-3vv5-8xxp-4f55"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Open WebUI: Cross-origin postMessage confirmation bypass via action:submit"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.