https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:06:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-54018 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata). This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False This vulnerability is fixed in 0.9.6.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata). This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False This vulnerability is fixed in 0.9.6.</p> https://vulnerability.circl.lu/vuln/cve-2026-54018 https://vulnerability.circl.lu/vuln/ghsa-jrfp-m64g-pcwv <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary The SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL.</p> <p>Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata).</p> <p>This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False</p> <p>### Details Root Cause</p> <p>The application validates the initial user-provided URL using self._safe_process_url_sync(url). This correctly resolves the domain and ensures it does not point to a private IP.</p> <p>The application then calls page.goto(url). By default, Playwright automatically follows HTTP redirects (301/302).</p> <p>The Bypass: If the destination server returns a redirect to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), the browser follows it without re-validating the new destination. The initial validation is bypassed because it only checked the first URL, not the entire redirect chain.</p> <p>```python for url in self.urls: try: self._safe_process_url_sync(url) page = browser.new_page() response = page.goto(url, timeout=self.playwright_timeout) #this if response is None: raise ValueError(...) text = self.evaluator.evaluate(page, browser, r…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary The SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL.</p> <p>Since Playwright automatically follows HTTP redirects (301/302) by default, an attacker can bypass the validation by providing a safe URL that redirects to a restricted internal network address (e.g., localhost, Docker container network, or Cloud Metadata).</p> <p>This allows the application to access internal services despite ENABLE_RAG_LOCAL_WEB_FETCH being set to False</p> <p>### Details Root Cause</p> <p>The application validates the initial user-provided URL using self._safe_process_url_sync(url). This correctly resolves the domain and ensures it does not point to a private IP.</p> <p>The application then calls page.goto(url). By default, Playwright automatically follows HTTP redirects (301/302).</p> <p>The Bypass: If the destination server returns a redirect to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), the browser follows it without re-validating the new destination. The initial validation is bypassed because it only checked the first URL, not the entire redirect chain.</p> <p>```python for url in self.urls: try: self._safe_process_url_sync(url) page = browser.new_page() response = page.goto(url, timeout=self.playwright_timeout) #this if response is None: raise ValueError(...) text = self.evaluator.evaluate(page, browser, r…</p> https://vulnerability.circl.lu/vuln/ghsa-jrfp-m64g-pcwv