Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Summary

Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET requests, and read back responses from same-origin or CORS-permissive targets into the rendered page. Because the request comes from the browser, server-side SSRF protections never see it.

Preconditions

Default configuration, no flags or environment variables involved: Vega blocks render unconditionally wherever chat content is displayed. The attacker needs an account that can put content in front of the victim, which covers a shared chat, a channel message, and model, RAG or tool output the attacker can influence. The victim must open the message, so this is not zero-click. Deployments where the victim's browser has no network position of interest lose little.

Impact

The victim's browser becomes a request proxy into whatever it can reach: internal hosts and ports behind the perimeter, same-site endpoints, and out-of-band beacons that confirm a chart was viewed and by whom. Where the target is same-origin or returns permissive CORS headers, the response body is pulled back into the chart in the victim's page, which turns the request into a read. Requests are GET only, and no server-side data is exposed to the attacker directly.

Fix

Fixed in 5278eb906 (#26806), released in 0.11.0. The view is now constructed with a loader whose load always throws and whose sanitize resolves the URI with the browser's own URL parser and permits only data: and same-origin results, so charts can only use inline data.values. Upgrading is sufficient; no configuration change is needed.

Root cause

• src/lib/utils/index.ts — renderVegaVisualization
• src/lib/components/chat/Messages/CodeBlock.svelte — renders vega/vega-lite blocks

The renderer treated a chart spec as trusted authored content rather than as untrusted chat text, so it accepted Vega's default loader. That loader has two separate ways out of the page: data.url and topojson/geo sources are fetched at view construction, and image marks pass their url through sanitize and are written into the output SVG as <image href>, which the browser fetches when the chart is displayed. The second path survives downstream SVG sanitization because the URL is a legitimate attribute value, not markup.