openwebui

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). High: the “Agentic Web Search & URL Fetching” workflow can call fetch_url, which extracts full page text from runtime-supplied external URLs and injects that extracted prose directly into the model context (up to ~50,000 chars), enabling outsider-authored prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). I flagged the agentic fetch_url behavior because the docs show the model calling fetch_url at runtime to retrieve and inject full-page content into its context (e.g., fetch_url("https://example.com/react-security-advisory-2026")), which is a runtime external fetch that directly controls the model's prompts/context.