Vulnerabilities

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims'…

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Oracle

Product

java

CVSS

7.3

Exposure class

AI infrastructure

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-109291 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 8
   CVE NVD 19d ago

   Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored…

   CVSS 4.6 CVE-2026-109300 Oracle
2. 8
   CVE NVD 19d ago

   Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency…

   CVSS 6.5 CVE-2026-109297
3. 15
   CVE NVD 19d ago

   Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to…

   CVSS 7.3 CVE-2026-109290 Node.js
4. 8
   CVE NVD 19d ago

   Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into…

   CVSS 6.4 CVE-2026-109288 Oracle