EUVD-2026-7982
GHSA-xc8p-9rr6-97r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessManually modify chat history JSON
-
ExploitSet html property in document metadata
-
ExecutionFrontend renders metadata as HTML in iFrame
-
ImpactStored XSS payload executes on citation preview
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Open WebUI versions prior to 0.7.0 with authenticated user access (PR:L) required to manually modify chat history. Victim must preview citation (UI:R) to trigger XSS execution. Requires ability to craft weaponized document payload in chat messages. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Stored XSS in Open WebUI prior to version 0.7.0 allows authenticated users to inject malicious HTML payloads into chat document metadata, which execute in the browser when citations are previewed or viewed in shared chats. Public exploit code exists for this vulnerability, and an attacker with login access can compromise any user who interacts with their weaponized chat documents. Upgrade to version 0.7.0 or later to remediate.
Earlier versions of this analysis (1)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the html property within document metadata. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Open Webui. Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat
Know when Open Webui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat. Version 0.7.0 fixes the issue.
Executive ViewAI
Open WebUI instances running versions prior to 0.7.0 are vulnerable to HTML injection attacks through manually modified chat history metadata. Attackers can inject malicious HTML content that may lead to stored cross-site scripting (XSS), potentially compromising user sessions, stealing credentials, or delivering malware to users accessing affected chat histories.
Implement strict input sanitization on the html property within document metadata; disable or restrict the manual chat history modification feature; apply Web Application Firewall (WAF) rules to detect and block HTML injection patterns in chat data; segment Open WebUI instances on isolated networks with limited user access; enable comprehensive audit logging of all chat history modifications; implement Content Security Policy (CSP) headers to prevent inline script execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Open Webui
View allAn XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui
Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traver
Stored cross-site scripting in Open WebUI's terminal port preview feature allows an authenticated attacker sharing a ter
In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing u
OAuth and SCIM identity confusion in Open WebUI 0.6.41-0.10.x (SQLite-backed deployments only) allows unauthenticated re
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS
Denial of service in Open WebUI versions 0.9.0-0.11.0 allows unauthenticated remote attackers to stall the application s
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. Rated hig
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. [CVSS 7.3 HIGH]
Improper privilege management in Open WebUI 0.10.0 through 0.11.0 allows any authenticated low-privilege user with write
Server-side request forgery in Open WebUI prior to 0.11.1 allows authenticated users to reach internal cloud infrastruct
Exploit-DB