Skip to content

CVE record · 1 source

CVE-2026-109290

CVSS 7.3

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to…

Vendor: Node.js
Product: Node.js, AI / LLM tooling
CVSS: 7.3
Exposure class: Developer platform, AI infrastructure

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

15

CVE NVD 19d ago

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to…

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML…

CVSS 7.3 CVE-2026-109290 Node.js