CVE-2026-56398 is a high severity (CVSS 7.3) stored cross-site scripting flaw in Open WebUI through version 0.9.4. An SVG supplied as an OAuth profile picture bypasses image validation. Upgrade to 0.9.5 or later, and review your OAuth setup and security headers.
What's affected
The GitHub advisory (GHSA-3wgj-c2hg-vm6q) lists the pip package open-webui, versions up to and including 0.9.4, with 0.9.5 as the patched version.
Only instances that use OAuth sign in are involved. When a user signs in with OAuth, Open WebUI fetches the picture URL from the identity provider's claim and stores it as the user's profile image. The advisory says the file type was guessed from the URL extension, and this path skipped the validator that normally allows only PNG, JPEG, GIF and WebP images.
An SVG stored this way is served back with an inline disposition, and the advisory notes that the security headers CSP and X-Content-Type-Options are only set when you enable them by environment setting.
How to check if you're exposed
Check the installed version.
pip show open-webui
For Docker, check the image tag. Version 0.9.4 or lower is affected.
Then see whether OAuth sign in is enabled in your deployment. If it is not, this path is not in use, although you should still upgrade.
Finally check whether your reverse proxy or application sets a Content Security Policy and the X-Content-Type-Options header. The advisory says they are not on by default.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade Open WebUI to 0.9.5 or later and restart the service.
- Enable the security header settings for your deployment, or add a Content Security Policy and nosniff at your reverse proxy.
- Review stored profile images for SVG data URIs, and replace any you did not expect.
- Limit which identity providers and accounts can sign in through OAuth.
- Sign out active sessions after you patch, so any stolen tokens stop working.
Why it matters
The record lists CWE-20, improper input validation. The server trusted a file type inferred from a URL extension instead of the declared content type, and one code path skipped the check that other paths use. An SVG is an image format that can carry script, so serving one as a top level document in the app's own origin lets that script run with the user's session.
The advisory says that script could read the stored authentication token and lead to account takeover. The vector needs a logged in user and one user interaction. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Two lessons carry over. Apply the same validation to every path that stores a file, and serve user supplied content with headers that stop the browser from running it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does the SVG matter?
SVG can contain script. The advisory says the file is served inline from the application's origin, where script can reach the user's stored token.
Sources
Last reviewed: 19 October 2026.
