Open WebUI versions from 0.6.34 to 0.11.0 allow any user to embed Vega or Vega‑Lite code blocks that are rendered directly in the viewer’s browser. The rendering engine does not restrict external resource loads, so an attacker can cause a victim’s browser to issue arbitrary GET requests. If the requested resource is same‑origin or CORS‑permissive, the response payload can be read in the victim’s page, effectively leaking data or enabling further exploitation. This client‑side SSRF flaw, classified as CWE‑918, could lead to confidential data exposure, policy violations, or secondary attacks originating from the victim’s browser context.

The vulnerable product is Open WebUI (open‑webui:open‑webui). All releases from 0.6.34 up to but excluding 0.11.0 contain the flaw. The issue is fixed in version 0.11.0 of Open WebUI.

The CVSS score of 4.1 signals moderate severity. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the flaw can be triggered with ordinary user interaction: a malicious participant who can insert a crafted block will compel a victim’s browser to fetch the target URL. An attacker might use this channel to reach internal services or read external data, depending on CORS allowances. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread known exploitation to date. Nevertheless, organizations hosting Open WebUI should treat the flaw as a moderate risk and upgrade promptly to mitigate potential data leakage or further compromise.