Open WebUI SSRF and XSS Vulnerabilities

Server-side request forgery in Open WebUI versions prior to 0.6.37 lets any authenticated user force the server to fetch arbitrary URLs through the /api/v1/retrieval/process/web endpoint, exposing cloud instance metadata services (AWS/GCP/Azure/Alibaba), internal network ranges, and services behind the firewall. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (7.1) - remotely reachable with low complexity, but it requires a valid session of any role, so instances that allow open self-registration effectively expose the endpoint to any network-reachable user. Publicly available exploit code exists (the GHSA includes a working curl PoC) and a vendor fix ships in 0.6.37; EPSS is low at roughly 0.04% (12th percentile), suggesting exploitation has not been observed at scale, though confirmed active exploitation (CISA KEV) has not been reported.

Stored cross-site scripting in Open WebUI's Notes PDF export (versions through 0.6.36) allows an attacker who can get crafted Markdown into a victim's Notes to execute JavaScript when the victim chooses 'Download PDF (.pdf)', exposing session/JWT tokens stored in the browser and enabling account takeover. The payload does not fire on import or normal viewing; exploitation requires the Notes feature and victim interaction (UI:R), and an external attacker can attempt it by sharing a malicious Markdown file for the victim to import. Publicly available exploit code exists, EPSS is low at 0.04% (13th percentile), and the issue is fixed in 0.6.37.