[GHSA-qr7m-hwp7-qjqg] Open WebUI PIP install_frontmatter_requirements Command...

[Classic298]

Updates

• Affected products
• Description
• References
• Summary

Comments
Vendor (Open WebUI maintainer) request to withdraw or mark this advisory as disputed. It does not describe a vulnerability: install_frontmatter_requirements is the documented and intended dependency mechanism of the Plugins feature, reachable only by admins or holders of the default-disabled workspace.tools permission. Out of scope per our published security policy (Rules 1/9/10). The corresponding GHSA report (GHSA-rjx7-v9ff-8jcq) was filed via our channel and closed as out-of-scope before ZDI published the CVE. Full vendor disposition: https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0765/

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[Classic298]

.

[shelbyc]

Hi @Classic298, my teammates and I never reviewed GHSA-qr7m-hwp7-qjqg because of its disputed status. It's not in the reviewed data set and not producing Dependabot alerts, so there is nothing to withdraw. GitHub can't do anything about disputing or withdrawing the underlying CVE record.

I wrote a blog post last year that links to documentation on how to dispute a CVE record when someone disagrees with the CNA, in this case Zero Day Initiative. ZDI's root CNA is MITRE.