ByteOS Network

CVE Vulnerability Details :

CVE-2026-45346

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-15 May, 2026 | 21:15

Updated At-15 May, 2026 | 21:15

▼CVE Numbering Authority (CNA)

Open WebUI: Stored Cross-Site Scripting in SVG Renderer

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.31, there is a Cross-Site Scripting vulnerability in Open WebUI SVG renderer implementation. This vulnerability is fixed in 0.6.31.

Affected Products

Vendor

open-webui

Product

open-webui

Versions

Affected

< 0.6.31

Problem Types

Type	CWE ID	Description
CWE	CWE-80	CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Type: CWE

CWE ID: CWE-80

Description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Metrics

Version	Base score	Base severity	Vector
4.0	5.1	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Version: 4.0

Base score: 5.1

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

Hyperlink	Resource
https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6	x_refsource_CONFIRM

Hyperlink: https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6

Resource:

x_refsource_CONFIRM

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References