Executive brief
Open WebUI is a web interface for managing AI models and chatbots. When the 'Insert Prompt as Rich Text' setting is enabled, an attacker with prompt creation permissions can inject malicious JavaScript code that executes in the browser of any user who runs the prompt command. This can lead to account takeover through session token theft or, for administrators, remote code execution on the server via Python function execution.
Technical details
This is a stored DOM XSS vulnerability in the RichTextInput.svelte component (line 348) where user-supplied prompt content is parsed with the marked.js library and then directly assigned to element.innerHTML without sanitization. While marked.parse() provides minimal escaping, it does not prevent XSS. The attack requires: (1) an attacker with USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS permission to create a prompt containing a malicious payload, and (2) a victim with the 'Insert Prompt as Rich Text' setting enabled to trigger the payload via a chat command. An attacker can bypass quote filtering by constructing JavaScript strings from decimal codepoints. The fix is to sanitize HTML output with DOMPurify before DOM assignment. A patch is available in version 0.6.35 and later.
Affected products
- Open WebUI Open WebUI <= 0.6.34
Timeline
- 2025-11-07: disclosed: Security advisory published on GitHub
- 2025-11-07: patched: Fix available in version 0.6.35