1 CRIT · 12 HIGH · 1 MED · 2 INFO · THREAT RED · 16 items · Generated in 284s
Unauthenticated attackers can bypass the patch and force npx to install and run arbitrary packages, leading to remote code execution.
Authenticated users can use server-side fetch to access internal services or cloud metadata and read sensitive responses.
Read-only users can access server-side tool code, exposing embedded secrets and internal logic.
A user can make the browser fetch internal URLs and leak internal data back through web-search or RAG output.
A logged-in attacker can bypass URL checks and make the app fetch internal resources, exposing data from private network services.
An attacker can make a victim's browser send network requests and read some responses, exposing internal or trusted resources.
Pending or deactivated users can bypass approval checks and get interactive terminal access if a terminal server is exposed to them.
Stored XSS can hijack viewer sessions and let a normal user take over admin accounts in Open WebUI.
An authenticated user can run script in the app origin and steal session tokens, leading to account takeover where terminal preview is enabled.
A low-privilege user may freeze the single worker event loop and disrupt HTTP, WebSocket, and scheduler availability.
A user with limited access can delete another knowledge base's directories and embeddings, breaking integrity across shared data.
Revoked users can still trigger server-side image generation, bypassing intended access controls under specific configuration.
AI-driven zero-day discovery can rapidly scale finding exploitable flaws across open-source dependencies.
Describes guardrails to limit AI agent intent drift; useful security practice, but no specific incident or flaw is stated.
Funding news signals market traction for AI agent governance, but it does not describe a specific security issue or exploit.
A public issue could prompt-inject an agent chain and trigger a privileged bot action in a trusted repository workflow.