CVE-2026-70480 in Open WebUI
Summary
by MITRE • 08/04/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user browser issue attacker-chosen outbound GET requests and read responses from same-origin or CORS-permissive targets into the rendered page. This issue is fixed in 0.11.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
This vulnerability exists within Open WebUI, a self-hosted AI platform that allows users to render vega and vega-lite visualizations through fenced code blocks in chat content. The flaw manifests when the application builds Vega views directly in the user's browser without implementing proper resource loading restrictions. This architectural oversight creates a significant security risk where malicious actors can craft specially formatted code blocks containing attacker-controlled vega specifications that trigger unintended browser behavior.
The technical implementation of this vulnerability stems from the lack of sandboxing or restricted resource loading mechanisms when processing vega and vega-lite content. When users place such code blocks in chat messages, the browser executes the visualization rendering process without proper origin isolation or network access controls. This allows attackers to construct vega specifications that force the victim's browser to make outbound GET requests to arbitrary URLs chosen by the attacker.
The operational impact of this vulnerability is substantial as it enables attackers to perform covert data exfiltration and reconnaissance activities through the victim's browser. An attacker who can inject a malicious fenced code block into a chat where another user will view it can cause that user's browser to make HTTP requests to targets within the same origin or CORS-permissive domains. This creates a server-side request forgery scenario where the victim's browser acts as an intermediary to access internal resources or sensitive data, potentially bypassing traditional network security controls.
This vulnerability aligns with CWE-94, which describes improper control of generation of code, and specifically relates to the execution of untrusted code in web browsers. The attack vector follows patterns consistent with web-based exploitation techniques documented in the MITRE ATT&CK framework under T1566 for spoofing and T1071 for application layer protocols. The issue represents a classic case of insufficient input validation combined with inadequate output encoding, creating an environment where user-provided content can influence browser behavior beyond intended functionality.
The fix implemented in version 0.11.0 addresses this by introducing proper resource loading restrictions and ensuring that vega and vega-lite visualizations are rendered within appropriate security boundaries. This likely involves implementing Content Security Policy controls, restricting external resource access, or using sandboxed iframe approaches for visualization rendering. Organizations using Open WebUI should immediately upgrade to version 0.11.0 or later to mitigate this risk, while also considering additional monitoring for unauthorized code block injection attempts in their chat environments.