There is a vulnerability on the /api/v1/util/pdf endpoint via SSRF and HTML injection. This PR applies a patch such that contents in the request are escaped to html characters before rendeing the HTML service side.
@tjbck we have flagged this as a vulnerability which is of medium risk.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/9733
**Author:** [@rragundez](https://github.com/rragundez)
**Created:** 2/10/2025
**Status:** ✅ Merged
**Merged:** 2/10/2025
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `dev` ← **Head:** `patch-ssrf`
---
### 📝 Commits (1)
- [`167c8bf`](https://github.com/open-webui/open-webui/commit/167c8bf00d165af523acfc3b870749f6be6d3e57) Prevent SSRF and HTML injection
### 📊 Changes
**1 file changed** (+7 additions, -6 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/utils/pdf_generator.py` (+7 -6)
</details>
### 📄 Description
There is a vulnerability on the /api/v1/util/pdf endpoint via SSRF and HTML injection. This PR applies a patch such that contents in the request are escaped to html characters before rendeing the HTML service side.
@tjbck we have flagged this as a vulnerability which is of medium risk.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/9733
Author: @rragundez
Created: 2/10/2025
Status: ✅ Merged
Merged: 2/10/2025
Merged by: @tjbck
Base:
dev← Head:patch-ssrf📝 Commits (1)
167c8bfPrevent SSRF and HTML injection📊 Changes
1 file changed (+7 additions, -6 deletions)
View changed files
📝
backend/open_webui/utils/pdf_generator.py(+7 -6)📄 Description
There is a vulnerability on the /api/v1/util/pdf endpoint via SSRF and HTML injection. This PR applies a patch such that contents in the request are escaped to html characters before rendeing the HTML service side.
@tjbck we have flagged this as a vulnerability which is of medium risk.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.