medium5.4
CVE-2026-45346
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.
Impact
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | open-webui | < 0.6.31 | 0.6.31 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openwebui | Open Webui | before 0.6.31 |