{"id":"CVE-2026-54007","title":"Open WebUI: Cross-origin postMessage confirmation bypass via action:submit","summary":"Open WebUI: Cross-origin postMessage confirmation bypass via action:submit","severity":"high","cwe":["CWE-346"],"vendor":"open-webui","product":"open-webui","ecosystem":"pip","affected":["open-webui <= 0.9.5"],"patched":["open-webui 0.9.6"],"published":"2026-06-17","updated":"2026-06-17","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-3vv5-8xxp-4f55","references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-3vv5-8xxp-4f55"},{"url":"https://github.com/advisories/GHSA-3vv5-8xxp-4f55"}],"tags":["ghsa","pip"],"epss":0.00231,"epssPercentile":0.14265,"ingestedAt":"2026-06-29T14:31:47.352Z","slug":"CVE-2026-54007","body":"## Overview\n\n### Summary\n\nThe chat message listener allows non-same-origin `input:prompt` and `action:submit` messages, so an external site can set prompt text and trigger `submitPrompt()` in an authenticated victim session. I validated this with a cross-origin attacker page that auto-posted messages and caused unauthorized `POST /api/v1/chats/new` and `POST /api/chat/completions` requests containing attacker-controlled prompts. This enables cross-site forced actions and model/tool execution under victim privileges without consent.\n\n### Details\n\nThe chat page's window message listener in `src/lib/components/chat/Chat.svelte` processes message types including `input:prompt` and `action:submit` without adequately enforcing same-origin restrictions. Based on code around lines ~597-616, input text is set directly from `event.data.text`; `action:submit` proceeds to `submitPrompt()` on the current prompt. The logic does not apply a strict origin allowlist and permits non-same-origin control of the chat input and submission flow, leading to cross-origin command execution in the victim's authenticated UI context. As a result, backend API calls (e.g., `POST /api/v1/chats/new`, `POST /api/chat/completions`) are sent under victim credentials.\n\nNormally, via the `input:prompt:submit` postMessage type, this results in a \"Confirm Prompt from Embed\" confirmation dialog:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L604-L622\n\nHowever, combining the two other types, it is possible to achieve the same effect without this confirmation:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/Chat.svelte#L584-L602\n\n### PoC\n\n1. Set up a local Open WebUI instance and log in to it, making sure a model is configured\n2. Host the following HTML anywhere and visit it (optionally change http://127.0.0.1:14000 to your instance Base URL):\n\n```html\n<h1>Click anywhere</h1>\n<script>\n  function sleep(ms) {\n    return new Promise(r => setTimeout(r, ms));\n  }\n  \n  onclick = async () => {\n    w = window.open('http://127.0.0.1:14000');\n    await sleep(2000);\n    w.postMessage({ type: 'input:prompt', text: \"INJECTED PROMPT\" }, '*');\n    await sleep(500);\n    w.postMessage({ type: 'action:submit' }, '*');\n  }\n</script>\n```\n\n3. Click anywhere on the page, then notice without further interaction the \"INJECTED PROMPT\" is executed on the Open WebUI instance\n\n<img width=\"874\" height=\"264\" alt=\"image\" src=\"https://github.com/user-attachments/assets/244d9015-0dbf-47e0-a30e-1c2fbbde5e58\" />\n\n### Impact\n\nConditions required: The victim must be authenticated to Open WebUI in the browser (token cookie present).\n\nThis issue enables cross-site forced actions under the victim's identity. An attacker can silently inject prompts and trigger model/tool execution (e.g., code interpreter, web search, retrieval, terminal/tool servers) as the victim without confirmation.\n\n### Original Agent Report\n\n<img width=\"400\" alt=\"app aikido dev_ai-pentests_projects_116389_assessments_019d67d4-81c8-7dd2-bb9e-0a4a774b2c78_issues_sidebarIssue=20439940 (4)\" src=\"https://github.com/user-attachments/assets/7b6521ed-d08b-446d-a918-103523d08a1e\" />\n\n## Affected packages\n\n- `open-webui <= 0.9.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `open-webui 0.9.6`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}