Vulnerabilities

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into…

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Oracle

Product

java

CVSS

6.4

Exposure class

Developer platform, AI infrastructure

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-109288 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 8
   CVE NVD 19d ago

   Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored…

   CVSS 4.6 CVE-2026-109300 Oracle
2. 8
   CVE NVD 19d ago

   Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency…

   CVSS 6.5 CVE-2026-109297
3. 15
   CVE NVD 19d ago

   Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims'…

   CVSS 7.3 CVE-2026-109291 Oracle
4. 15
   CVE NVD 19d ago

   Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to…

   CVSS 7.3 CVE-2026-109290 Node.js