Open WebUI CVE-2026-109300

Requires: (1) a valid authenticated account on the target Open Webui instance able to post channel messages, chat messages, or citation content (PR:L); (2) the attacker crafting a Markdown tool-call details block whose embeds attribute is treated as tool output and mounted in a script-enabled iframe; and (3) a victim passively viewing the malicious content (UI:P). Limiting factors: exploitation is confined to versions 0.6.31 up to (not including) 0.11.4; it cannot be performed unauthenticated; and escalation to session hijacking specifically requires the non-default-sensitive iframeSandboxAllowSameOrigin option to be enabled - without it, impact is limited to in-app phishing and arbitrary script execution in the viewer's session.

This is a moderate-severity stored XSS (CVSS 4.0 base 5.1, CWE-79) that should be treated as a real-but-not-urgent patching priority rather than an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N) confirms network reachability and low attack complexity, but two factors meaningfully constrain real-world risk: PR:L means the attacker must already hold a valid authenticated account on the instance, and UI:P means a victim must passively view the malicious message/citation for the payload to fire. Impact is rated low on confidentiality and integrity only (no availability), consistent with in-browser script execution rather than host compromise. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are internally consistent (medium CVSS, no exploitation telemetry) rather than conflicting. The one escalation path worth flagging is conditional: the description states session hijacking is possible only where iframeSandboxAllowSameOrigin is enabled, so impact varies by configuration. Note the description emphasizes that payloads run JavaScript in viewers' browsers (a sandbox/scope escape typical of XSS), which arguably warrants a scope change - see assessed vectors below.

An attacker who already has an account on an Open Webui instance (0.6.31 up to but not including 0.11.4) posts a crafted channel message, chat message, or citation containing a Markdown tool-call details block whose embeds attribute carries malicious markup. When another user views that content, the Markdown renderer mounts the embed in a script-enabled iframe and executes the attacker's JavaScript in the victim's browser, enabling in-app phishing or, where iframeSandboxAllowSameOrigin is enabled, session hijacking. No public exploit code was identified at time of analysis; exploitation requires low complexity but depends on a victim viewing the content.