CVE-2026-109288: Open WebUI stored cross-site scripting in markdown link rendering

CVE-2026-109288 · Severity: medium · CVSS 6.4 · Published 2026-10-12

Open WebUI is a web-based user interface for interacting with AI models and sharing chat sessions. An authenticated attacker can craft a shared chat containing a malicious javascript: link that steals the session token of any user who clicks it, potentially granting the attacker full account access including administrative privileges. The vulnerability affects all versions before 0.11.4, and victims on certain browsers like Safari and Firefox are at risk.

Technologies: Open WebUI. Vendors: Open WebUI.

Quick answers

Is CVE-2026-109288 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-109288 being exploited in the wild.
How severe is CVE-2026-109288?
Medium severity, with a CVSS score of 6.4, published 12 October 2026.
Which products and versions are affected?
Open WebUI before 0.11.4.
Is there a fix for CVE-2026-109288?
Yes: fixed in 0.11.4. Until then: Set a Content-Security-Policy header to forbid inline scripts, which prevents the javascript: URL execution. Disable the chat sharing feature (chat.share permission) if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109288 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-109288?
Check whether you run Open WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.11.4

Set a Content-Security-Policy header to forbid inline scripts, which prevents the javascript: URL execution. Disable the chat sharing feature (chat.share permission) if not required.

Technical details

A stored XSS vulnerability exists in MarkdownInlineTokens.svelte where markdown link URLs are rendered into anchor href attributes without scheme validation. Authenticated users (with chat sharing permission enabled by default) can embed javascript: scheme links in shared chat content; when a victim clicks the link, the JavaScript executes in the victim's session context and reads their JWT token from local storage. The vulnerability requires user interaction (clicking the link) and network access, and affects WebKit browsers (Safari, iOS browsers) universally and Firefox with modifier keys; Chromium-based browsers are unaffected due to stricter URL handling.

Affected products

  • Open WebUI Open WebUI before 0.11.4

Timeline

  • 2026-09-27: disclosed
  • 2026-10-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.