Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| open-webui | pip | >= 0.6.34, < 0.11.0 | 0.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the renderVegaVisualization function located in src/lib/utils/index.ts. The root cause is the use of the vega.View constructor without a restricted resource loader. The provided commit 5278eb906ebecefc6538a19bc86df09d997e43e6 directly addresses this by introducing a custom loader. This new loader explicitly blocks any external resource loading by overriding the load method to always throw an error and wrapping the sanitize method to only allow data: URIs and same-origin resources. The vulnerability description correctly identifies renderVegaVisualization as the location of the root cause. An attacker can exploit this by sending a specially crafted Vega/Vega-Lite JSON in a chat message, which, when rendered by the victim, triggers outbound requests from the victim's browser.
renderVegaVisualizationsrc/lib/utils/index.ts