Executive brief
Open WebUI is a web application that allows users to create and manage notes in Markdown format. A vulnerability in the PDF download feature allows attackers to inject malicious JavaScript code into notes, which executes when a victim downloads the note as a PDF file. An authenticated attacker or external user can exploit this to steal session tokens and compromise user accounts.
Technical details
This is a stored DOM-based cross-site scripting (XSS) vulnerability in the Notes feature's PDF download functionality. The vulnerable code in src/lib/components/notes/utils.ts directly assigns user-controlled HTML content to innerHTML without sanitization or validation, allowing malicious SVG or script tags to be stored and later executed. An authenticated attacker can import a specially crafted Markdown file containing SVG payloads with event handlers (e.g., onload="navigator.sendBeacon()"), and when a victim downloads the note as PDF, the JavaScript executes in the victim's browser context with access to localStorage tokens. The root cause is incomplete TipTap editor configuration that does not block dangerous tags and missing DOMPurify sanitization during PDF generation. A patch is available in version 0.6.37 that sanitizes HTML output using DOMPurify with a strict allowlist.
Affected products
- Open WebUI Open WebUI <= 0.6.36
Timeline
- 2025-12-04: disclosed
- 2025-12-04: patched: Fixed in version 0.6.37