Executive brief
Open WebUI, a user interface for interacting with AI models, is vulnerable to a security flaw where malicious code can be hidden inside chat messages. If a user views a shared chat containing this code, an attacker can take over their account and steal sensitive access tokens. If an administrator views the malicious chat, the attacker could potentially gain full control over the server hosting the application.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Open WebUI due to improper neutralization of input in the MarkdownTokens.svelte component. The application uses the dangerous {@html} Svelte tag to render iframe elements if they contain a specific API file path, allowing attackers to inject arbitrary JavaScript via attributes like 'onload'. An attacker can exploit this by sharing a malicious chat transcript; when viewed, the script can steal the user's localStorage access token. If the victim is an administrator, the attacker can use the stolen session to create malicious 'functions' (Python scripts), resulting in remote code execution (RCE) on the backend server. This vulnerability is also present on the openwebui.com community platform.
Affected products
- Open WebUI open-webui < 0.6.6
Timeline
- 2025-05-05: disclosed
- 2025-05-05: patched: Fixed in version 0.6.6
- 2026-07-07: advisory