CVE-2024-7983: Open WebUI denial of service through endpoint for converting markdown

March 20, 2025 (updated March 21, 2025)

In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.

References

github.com/advisories/GHSA-5v9m-57mq-qc75
github.com/open-webui/open-webui
github.com/open-webui/open-webui/blob/eff736acd2e0bbbdd0eeca4cc209b216a1f23b6a/backend/apps/webui/routers/utils.py
huntr.com/bounties/f8156ca5-1328-480f-a72b-8d3dfdad87dc
nvd.nist.gov/vuln/detail/CVE-2024-7983

Code Behaviors & Features

Detect and mitigate CVE-2024-7983 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →