Security advisories

medium2026-05-14

Svelte: SSR XSS via Insecure Promise Serialization in hydratable

sveltejs/svelte · GHSA-f3cj-j4f6-wq85

medium2026-05-14

CVE-2026-45787-electerm's encrypt method not safe enough

electerm/electerm · GHSA-g29v-q6h7-76wh

critical2026-05-14

CVE-2026-45353-Electerm Local code through electerm's single-instance socket

electerm/electerm · GHSA-7p5m-v798-f8vv

critical2026-05-14

CVE-2026-45374-DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files

hmbown/deepseek-tui · GHSA-72w5-pf8h-xfp4

high2026-05-14

CVE-2026-45373-DeepSeek TUI has SSRF‌ IPV6 bypass

hmbown/deepseek-tui · GHSA-88gh-2526-gfrr

critical2026-05-14

CVE-2026-45311-DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval

hmbown/deepseek-tui · GHSA-wx44-2q6h-j6p8

high2026-05-14

CVE-2026-45310-DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool

hmbown/deepseek-tui · GHSA-96ff-gc8g-wpvg

medium2026-05-14

CVE-2026-42573-Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State

sveltejs/svelte · GHSA-rcqx-6q8c-2c42

medium2026-05-14

CVE-2026-42567-Svelte: ReDoS in `<svelte:element>` Tag Validation

sveltejs/svelte · GHSA-9rmh-mm8f-r9h6

high2026-05-14

CVE-2026-45675-Open WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin Accounts

open-webui/open-webui · GHSA-h3ww-q6xx-w7x3

high2026-05-14

CVE-2026-45672-Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassed

open-webui/open-webui · GHSA-482j-2pq6-q5w4

high2026-05-14

CVE-2026-45671-Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion

open-webui/open-webui · GHSA-26g9-27vm-x3q8

medium2026-05-14

CVE-2026-45667-Open WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)

open-webui/open-webui · GHSA-m69w-p7m4-585j

medium2026-05-14

CVE-2026-45666-Open WebUI has an Indirect Object Reference (IDOR) in user notes

open-webui/open-webui · GHSA-x3qm-p8hr-3c3h

high2026-05-14

CVE-2026-45665-Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order

open-webui/open-webui · GHSA-cqp4-qqvg-3787

high2026-05-14

CVE-2026-45402-Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints

open-webui/open-webui · GHSA-r472-mw7m-967f

high2026-05-14

Open WebUI vulnerable to stored XSS via OAuth picture claim stored as SVG data URI in profile_image_url

open-webui/open-webui · GHSA-3wgj-c2hg-vm6q

high2026-05-14

CVE-2026-45401-Open WebUI has a SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints (not addressed by CVE-2025-65958)

open-webui/open-webui · GHSA-rh5x-h6pp-cjj6

high2026-05-14

CVE-2026-45400-Open WebUI has a Server-Side Request Forgery (SSRF) bypass in `validate_url`

open-webui/open-webui · GHSA-8w7q-q5jp-jvgx

high2026-05-14

CVE-2026-45399-Open WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption

open-webui/open-webui · GHSA-8jjp-r2w2-4v22