GHSA-6gh2-q7cp-9qf6
MEDIUMGHSA-6gh2-q7cp-9qf6 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in open-webui. O3 Security confirms whether GHSA-6gh2-q7cp-9qf6 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Open WebUI has Stored Cross-Site Scripting In Profile Picture
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-6gh2-q7cp-9qf6.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-6gh2-q7cp-9qf6 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 358,265 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
open-webuiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The profile_image_url field on the user profile update form accepted arbitrary data: URI values without MIME-type validation. Two distinct attack paths were independently demonstrated by separate reporters:
-
data:text/html;base64,...in a new browser tab (raresvis, 2025-04-17) — when a victim right-clicks a user's profile picture and chooses "Open image in new tab", the browser navigates to the data: URL and executes embedded scripts in thedata:origin. Limited to social-engineering / redirect attacks because the script does not run in the application origin. -
data:image/svg+xml;base64,...re-served by the application origin (Gh05t666nero, 2026-01-09) —GET /api/v1/users/{user_id}/profile/imagedecoded the base64 and returnedStreamingResponse(media_type=<user-controlled>)extracted from thedata:header. Withmedia_type=image/svg+xmlandContent-Disposition: inline, the SVG-embedded scripts executed in the application origin, enabling JWT theft fromlocalStorageand full account takeover of any user — including admins — who loaded the malicious profile image URL.
Both attack paths share the same root cause (lack of MIME-type validation on profile_image_url) and are closed by the same fix.
Vulnerable code (v0.7.0)
backend/open_webui/routers/users.py get_user_profile_image_by_id():
elif user.profile_image_url.startswith("data:image"):
header, base64_data = user.profile_image_url.split(",", 1)
image_data = base64.b64decode(base64_data)
image_buffer = io.BytesIO(image_data)
media_type = header.split(";")[0].lstrip("data:") # user-controlled
return StreamingResponse(
image_buffer,
media_type=media_type,
headers={"Content-Disposition": "inline"},
)
Fix
Commit 773787c74 (2026-02-11), first contained in tag v0.8.0, applies the validate_profile_image_url field validator to every form that accepts profile_image_url (UserModel, UpdateProfileForm, SignupForm in backend/open_webui/models/users.py and backend/open_webui/models/auths.py). The validator explicitly rejects data:image/svg+xml and any non-image data URI, allowing only data:image/{png,jpeg,gif,webp};base64 plus known internal paths and http(s):// URLs. This blocks both attack vectors at form submission time, so a malicious URL can no longer be persisted to the database.
Credits
- raresvis — discovered the
data:text/html-via-new-tab path - Gh05t666nero — discovered the
data:image/svg+xml-via-server-side path (the more severe origin-XSS vector that determined the consolidated CVSS)
Per our Report Handling policy, the cluster is consolidated into the earliest filing with credit to every reporter who demonstrated a distinct exploitation path.
Affected / patched versions
- Affected:
< 0.8.0 - Patched:
>= 0.8.0
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | open-webui | all versions | 0.8.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for open-webui. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update open-webui to 0.8.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-6gh2-q7cp-9qf6 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-6gh2-q7cp-9qf6 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-6gh2-q7cp-9qf6. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-6gh2-q7cp-9qf6 in your dependencies?
O3 detects GHSA-6gh2-q7cp-9qf6 across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.