Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | <= 0.9.5 | 0.9.6 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-jrfp-m64g-pcwv, is a Server-Side Request Forgery (SSRF) in the Open WebUI's Playwright-based web loader. The root cause is the application's failure to validate URLs after an HTTP redirect. The SafePlaywrightURLLoader class contains lazy_load (synchronous) and alazy_load (asynchronous) methods responsible for fetching web content. In vulnerable versions (<= 0.9.5), these functions would validate the initial user-provided URL but then use Playwright's page.goto() function, which follows redirects by default. This allowed an attacker to supply a seemingly benign URL that redirects to a private or internal IP address (e.g., 127.0.0.1, cloud metadata endpoints), bypassing the initial SSRF check.
The patch, found in commit f02aeea0bbd5fee6c223008baa7c0a28b1e98ac5, introduces request interception for all navigation events within Playwright. It adds new helper methods (_intercept_navigation_sync and _intercept_navigation) that re-validate the URL for every document request, including those initiated by redirects. The lazy_load and alazy_load functions were modified to register these interceptors using page.route() before calling page.goto(). Therefore, any attempt to exploit this vulnerability would involve a call to either SafePlaywrightURLLoader.lazy_load or SafePlaywrightURLLoader.alazy_load, making them the key indicators of exploitation in a runtime profile.
SafePlaywrightURLLoader.lazy_loadbackend/open_webui/retrieval/web/utils.py
SafePlaywrightURLLoader.alazy_loadbackend/open_webui/retrieval/web/utils.py
# attack_server.py
from flask import Flask, redirect
app = Flask(__name__)
@app.route('/')
def attack():
# Redirect to the Open WebUI container's internal port
return redirect("http://open-webui:8080/api/version", code=302)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
The Playwright browser follows the redirect to the internal address (http://open-webui:8080/api/version)
implement a request interceptor using Playwright's page.route. This ensures all requests, including redirects, are validated before connection.
apply the following logic to both lazy_load and alazy_load methods:
# async context
async def intercept_route(route):
try:
await run_in_threadpool(validate_url, route.request.url)
await route.continue_()
except Exception:
await route.abort()
await page.route("**/*", intercept_route)
response = await page.goto(url, timeout=self.playwright_timeout)