Open WebUI CVE-2026-109291

Requires an authenticated Open WebUI account (PR:L) on an instance running a version in the 0.6.33-to-before-0.11.4 range, and depends on the sharing feature: the attacker must store a javascript: URL in a citation's embed_url field within a chat and share that chat with a victim. Exploitation completes only when the victim actively clicks the malicious citation, which passes the URL to window.open (UI:P required) - it does not fire automatically. Limiting factors: attacker must already have a valid account, the target must use a vulnerable version, and victim interaction (clicking the crafted citation in a shared chat) is mandatory, so default single-user or non-sharing deployments and patched instances (0.11.4+) are not exposed.

This is a credible, moderately-high priority issue for organizations running affected Open WebUI versions, but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L - an authenticated user account) and passive user interaction (UI:P - the victim must click the malicious citation), with high confidentiality and integrity impact and no availability impact. The real-world danger is account takeover via theft of localStorage.token. However, several high-confidence risk signals are MISSING from the input: no EPSS score is provided, so exploitation probability cannot be quantified; there is no CISA KEV listing (no public exploit identified at time of analysis); and no POC availability is indicated despite a published GHSA advisory. The requirement for both a valid authenticated account AND victim interaction (clicking a shared crafted chat's citation) meaningfully constrains mass or opportunistic exploitation, pushing this toward targeted social-engineering use rather than wormable, widespread attack. Net: a genuine stored-XSS-to-account-takeover flaw worth prompt patching on exposed multi-user instances, but absent EPSS/KEV/POC evidence it is not demonstrably under active exploitation.

An authenticated Open WebUI user crafts a chat containing a citation whose embed_url field holds a javascript: URL, then shares that chat with a victim. When the victim opens the shared chat and clicks the citation, the URL is passed to window.open, executing attacker script in the victim's session to exfiltrate localStorage.token and hijack the account. No public exploit code is identified in the provided data, and successful exploitation depends on the victim actively clicking the malicious citation (UI:P).