Open WebUI CVE-2026-109288

Requires an authenticated account on the Open WebUI instance (any low-privilege user suffices, PR:L) and use of the chat-sharing feature; the attacker plants a markdown link with a javascript: scheme that MarkdownInlineTokens.svelte renders directly into an anchor href without scheme validation (versions before 0.11.4). Exploitation is gated by victim interaction: a second user must open the shared chat AND click the malicious link for the script to run, and high-value compromise specifically depends on an administrator being the victim. JWT storage in browser local storage is what makes token theft possible. These factors - prior authentication plus a required click by a privileged victim - limit this to targeted social-engineering use rather than unauthenticated mass exploitation.

This is a credible, moderately serious risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:A, score 7.2 HIGH) tells a consistent story: network-reachable, low complexity, but requiring low-privilege authentication (PR:L - any registered Open WebUI user) AND active victim interaction (UI:A - the victim must click the malicious link), with an attack requirement present (AT:P, i.e. the attacker needs a victim, ideally an admin, to take the bait). The impact metrics VC:H/VI:H are justified: stealing a JWT from local storage yields full session takeover, and if an admin clicks, the attacker inherits administrative control. No EPSS score, KEV listing, or POC reference was provided in the input, so exploitation probability signals are absent - this is NOT confirmed as actively exploited. The description is internally consistent with the CVSS vector (authenticated low-priv attacker, victim-click required), so there is no network-vs-local conflict to flag. The dependency on social engineering (a victim, especially an admin, must click an attacker-planted link) and on prior authentication meaningfully lowers real-world risk below what the 7.2 base score alone suggests; this favors targeted rather than opportunistic/wormable exploitation.

An authenticated low-privilege Open WebUI user creates or edits a chat containing a markdown link whose URL uses the javascript: scheme, then shares that chat. When another user - ideally an administrator - opens the shared chat and clicks the link, the unvalidated href executes attacker-controlled JavaScript in the victim's browser, exfiltrating the victim's JWT from local storage and enabling full account (including admin) takeover. No public exploit was identified in the provided data, but the technique is straightforward to reproduce.