Open WebUI’s channel webhook creation and update endpoints accept arbitrary profile_image_url values, including data:image/svg+xml;base64 URLs that embed SVG content. The service decodes and serves this SVG as image/svg+xml without sanitization, allowing attacker‑controlled script handlers such as onload to execute when the profile image URL is opened in the browser. This flaw, identified with CWE‑87, remained unpatched until version 0.9.3 and enables remote JavaScript execution in the victim’s context.

All installations of Open WebUI earlier than version 0.9.3 are affected. The vulnerability exists in the open‑webui product when the webhook create or update flow processes a profile_image_url value.

The CVSS score of 7.4 indicates a high impact when exploited. The flaw is remotely exploitable via the public webhook endpoint, and the lack of a KEV status suggests it is not currently known to be exploited in the wild. The attack requires the attacker to craft a malicious webhook payload with a data:image/svg+xml base64 payload; when a user opens the offending image, the browser executes the injected script, potentially leading to session hijacking, data theft, or defacement.