RepoJournal
Open WebUI @open-webui
73 wires and counting

$ follow Open WebUI

Keep up with Open WebUI in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-05-11
stories 37
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Open WebUI 0.9.5 ships with security hardening across image URLs, tool permissions, and iframe CSP

By RepoJournal · Filed · About Open WebUI

Classic298 Timothy Jaeryang Baek
2 people shipped this
Classic298 @Classic298 3 cited Timothy Jaeryang Baek @tjbck 2 cited

Open WebUI released 0.9.5 [ref:4] alongside three security-focused changes that tighten URL validation, align tool update permissions, and introduce a configurable iframe content security policy.

Open WebUI 0.9.5 is out [1]. Alongside the release, three changes harden security where user and untrusted content touches the server. The image router's get_image_data() now calls validate_url() before fetching the URL returned by the configured image generation API, matching the existing gate in load_url_image() [2]. This closes a vector where a malicious or misconfigured image API response could point the server at an arbitrary URL.

Tool content updates now require workspace.tools permission, aligning update_tools_by_id with the create endpoint [3]. Previously, a write grant on the tool was enough; now a user with tool-level write access but without workspace.tools permission cannot edit the tool's content, even if they could before. This is a breaking change for metadata-collaboration workflows.

A new IFRAME_CSP environment variable injects a Content-Security-Policy <meta> tag into all srcdoc iframes rendering untrusted content: artifacts, FullHeightIframe, FilePreview, and CitationModal [4]. The shared utility in src/lib/utils/csp.ts performs HTML-safe attribute escaping. Finally, the per-id model endpoint now strips the params dict for read-only callers, closing a gap where the admin-curated system prompt and behavior config were exposed to any read-access caller [5].

Action items

References

  1. [1] 0.9.5 ↗ open-webui/open-webui
  2. [2] chore: add validate_url() to get_image_data() for cohort consistency hardening (#24518) ↗ open-webui/open-webui
  3. [3] fix: gate tool content updates behind workspace.tools to match create endpoint (#24513) ↗ open-webui/open-webui
  4. [4] feat: add IFRAME_CSP env var for srcdoc iframe content security policy ↗ open-webui/open-webui
  5. [5] fix: strip model params for read-only callers on per-id endpoint (#24525) ↗ open-webui/open-webui

$ ls open-webui/reviews/ # the step-back reads

the week in review Open WebUI 0.11.2 ships as nine security advisories land the month in review Open WebUI 0.11.1 adds tool approval, 0.11.2 fixes
Topics: Local LLMs AI / ML Full archive →

Quick answers

What shipped in Open WebUI on May 11, 2026?
Open WebUI released 0.9.5 [ref:4] alongside three security-focused changes that tighten URL validation, align tool update permissions, and introduce a configurable iframe content security policy. In total, 26 commits, 10 pull requests, and 1 releases landed.
Who contributed to Open WebUI on May 11, 2026?
2 developers shipped this update, including Classic298 and Timothy Jaeryang Baek.
What were the notable Open WebUI updates?
0.9.5, chore: add validate_url() to get_image_data() for cohort consistency hardening (#24518), and fix: gate tool content updates behind workspace.tools to match create endpoint (#24513).
♥

$ log @open-webui --recent

Open WebUI ships five security fixes for auth and request handling 8 shipped Four breaking security advisories expose data and enable account takeover in Open WebUI 17 shipped Open WebUI 0.11.2 ships with tool parsing fix 90 shipped Fixes Redis Cluster stop, German catalog drift 8 shipped

$ log --all # elsewhere on the wire

@golang Fast-path receive buffer cleared on stream reset Meta React Native adds Stable API guards to renderer attributed string

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.