[GH-ISSUE #21124] [Hardening] Supply Chain Security: Verify integrity of auto-downloaded embedding models #139117

New Issue

2026-05-25T12:25:06-05:00

GiteaMirror commented

2026-05-25 12:25:06 -05:00

Originally created by @arsbr on GitHub (Feb 3, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/21124

Check Existing Issues

I have searched for all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Verify Feature Scope

I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.

Problem Description

I am submitting a Security Hardening Recommendation regarding the automatic model download mechanism in backend/open_webui/retrieval/utils.py.

Currently, when RAG_EMBEDDING_MODEL is set, the system downloads the model via huggingface_hub and immediately loads it into SentenceTransformer. Since these models often rely on pickle (via PyTorch), loading an untrusted model leads to RCE.

While I understand that configuring a malicious model URL falls under "Admin Actions" (and is thus out of scope for a vulnerability report), I believe the system should implement Defense in Depth to prevent accidental compromise or MITM attacks during the download process.

The Risk

An admin sets RAG_EMBEDDING_MODEL to a repository that contains a malicious pickle file (e.g., a typosquatted repo or a compromised upstream repo).
Open WebUI downloads it using snapshot_download.
SentenceTransformer loads it, executing the payload.

There is currently no check for:

Integrity: Does the downloaded file match the official hash? (MITM protection)
Malware: Is there an RCE payload inside the pickle?
License: Is the model legally safe to use?

Desired Solution you'd like

I suggest adding a verification layer inside get_model_path before returning the path to the loader.

I maintain an open-source library called Veritensor (Apache 2.0) that handles this logic. Even if you do not wish to add a new dependency, the logic can be adapted.

Suggested Implementation (in backend/open_webui/retrieval/utils.py):

# ... imports ...
# from veritensor.engines.static.pickle_engine import scan_pickle_stream

def get_model_path(model: str, update_model: bool = False):
    # ... existing download logic ...
    try:
        model_repo_path = snapshot_download(**snapshot_kwargs)
        
        # [PROPOSED HARDENING]
        # Scan downloaded artifacts before loading
        # 1. Check for Pickle RCE payloads (AST emulation)
        # 2. Verify hashes against HF Registry (if applicable)
        
        # Example logic:
        # scan_results = veritensor.scan(model_repo_path)
        # if scan_results.has_threats:
        #     raise RuntimeError(f"Model blocked due to security risks: {scan_results.threats}")

        log.debug(f"model_repo_path: {model_repo_path}")
        return model_repo_path
    except Exception as e:
        # ...

I've also attached an example of the full code.

[openwebui_scan.py](https://github.com/user-attachments/files/25046963/openwebui_scan.py)

### Alternatives Considered

_No response_

### Additional Context

In accordance with your security policy: I used AI assistance to generate the example code snippets, but the architectural analysis and the proposed solution were verified manually.

Originally created by @arsbr on GitHub (Feb 3, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/21124 ### Check Existing Issues - [x] I have searched for all existing **open AND closed** issues and discussions for similar requests. I have found none that is comparable to my request. ### Verify Feature Scope - [x] I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions. ### Problem Description I am submitting a **Security Hardening Recommendation** regarding the automatic model download mechanism in `backend/open_webui/retrieval/utils.py`. Currently, when `RAG_EMBEDDING_MODEL` is set, the system downloads the model via `huggingface_hub` and immediately loads it into `SentenceTransformer`. Since these models often rely on `pickle` (via PyTorch), loading an untrusted model leads to RCE. While I understand that configuring a malicious model URL falls under "Admin Actions" (and is thus out of scope for a vulnerability report), I believe the system should implement **Defense in Depth** to prevent accidental compromise or MITM attacks during the download process. The Risk 1. An admin sets `RAG_EMBEDDING_MODEL` to a repository that contains a malicious pickle file (e.g., a typosquatted repo or a compromised upstream repo). 2. Open WebUI downloads it using `snapshot_download`. 3. `SentenceTransformer` loads it, executing the payload. There is currently no check for: - **Integrity:** Does the downloaded file match the official hash? (MITM protection) - **Malware:** Is there an RCE payload inside the pickle? - **License:** Is the model legally safe to use? ### Desired Solution you'd like I suggest adding a verification layer inside `get_model_path` before returning the path to the loader. I maintain an open-source library called **[Veritensor](https://github.com/ArseniiBrazhnyk/Veritensor)** (Apache 2.0) that handles this logic. Even if you do not wish to add a new dependency, the logic can be adapted. **Suggested Implementation (in `backend/open_webui/retrieval/utils.py`):** ```python # ... imports ... # from veritensor.engines.static.pickle_engine import scan_pickle_stream def get_model_path(model: str, update_model: bool = False): # ... existing download logic ... try: model_repo_path = snapshot_download(**snapshot_kwargs) # [PROPOSED HARDENING] # Scan downloaded artifacts before loading # 1. Check for Pickle RCE payloads (AST emulation) # 2. Verify hashes against HF Registry (if applicable) # Example logic: # scan_results = veritensor.scan(model_repo_path) # if scan_results.has_threats: # raise RuntimeError(f"Model blocked due to security risks: {scan_results.threats}") log.debug(f"model_repo_path: {model_repo_path}") return model_repo_path except Exception as e: # ... I've also attached an example of the full code. [openwebui_scan.py](https://github.com/user-attachments/files/25046963/openwebui_scan.py) ### Alternatives Considered _No response_ ### Additional Context In accordance with your security policy: I used AI assistance to generate the example code snippets, but the architectural analysis and the proposed solution were verified manually.

GiteaMirror closed this issue

2026-05-25 12:25:10 -05:00

GiteaMirror commented

2026-05-25 12:25:14 -05:00

@pr-validator-bot commented on GitHub (Feb 3, 2026):

⚠️ Missing Issue Title Prefix

@ArseniiBrazhnyk, your issue title is missing a prefix (e.g., bug:, feat:, docs:).

Please update your issue title to include one of the following prefixes:

bug: Bug report or error you've encountered
feat: Feature request or enhancement suggestion
docs: Documentation issue or improvement request
question: Question about usage or functionality
help: Request for help or support

Example: bug: Login fails when using special characters in password

@pr-validator-bot commented on GitHub (Feb 3, 2026): # ⚠️ Missing Issue Title Prefix @ArseniiBrazhnyk, your issue title is missing a prefix (e.g., `bug:`, `feat:`, `docs:`). Please update your issue title to include one of the following prefixes: - **bug**: Bug report or error you've encountered - **feat**: Feature request or enhancement suggestion - **docs**: Documentation issue or improvement request - **question**: Question about usage or functionality - **help**: Request for help or support Example: `bug: Login fails when using special characters in password`

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#139117