# CVE-2026-109291: Open WebUI stored cross-site scripting in citation embed_url

Source: https://junglewise.ai/threats/cve-2026-109291-open-webui-from-0-6-33-before-0-11-4-contains-a-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109291 · Severity: high · CVSS 7.3 · Published 2026-10-12

Open WebUI is a web-based interface for managing and interacting with language models. An authenticated user can craft a malicious chat with javascript: links in citation fields and share it with another user. When a victim clicks the citation in a shared chat, the attacker's script executes in the victim's browser session, allowing the attacker to steal the victim's authentication token and impersonate them, including accessing private conversations.

Technologies: [Open WebUI](https://junglewise.ai/threats/technologies/open-webui-open-webui). Vendors: [Open WebUI](https://junglewise.ai/threats/vendors/open-webui).

## Quick answers

**Is CVE-2026-109291 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109291 being exploited in the wild.

**How severe is CVE-2026-109291?** High severity, with a CVSS score of 7.3, published 12 October 2026.

**Which products and versions are affected?** Open WebUI 0.6.33 through 0.11.3.

**Is there a fix for CVE-2026-109291?** Yes: fixed in 0.11.4. Until then: Upgrade to Open WebUI 0.11.4 or later, which validates embed_url values to accept only http, https, and protocol-relative URLs before opening them in window.open, rejecting javascript: and data: schemes.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-27"}, {"kind": "advisory", "at": "2026-10-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109291 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109291?** Check whether you run Open WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.11.4

Upgrade to Open WebUI 0.11.4 or later, which validates embed_url values to accept only http, https, and protocol-relative URLs before opening them in window.open, rejecting javascript: and data: schemes.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-09-27"}, {"kind": "advisory", "at": "2026-10-12"}]

## Technical details

A stored cross-site scripting vulnerability exists in the citation click handler in Citations.svelte where the embed_url field is passed directly to window.open() without validating the URL scheme. An authenticated attacker can inject javascript: URLs into their own chat citations via the chat update API, and when a victim opens the shared read-only chat and clicks the citation, the malicious script executes in the victim's origin with their session context, allowing token exfiltration and account takeover. The vulnerability requires victim user interaction (clicking the citation) and affects all versions from 0.6.33 through 0.11.3.

## Affected products

- open-webui Open WebUI 0.6.33 through 0.11.3

## References

- [https://github.com/open-webui/open-webui/security/advisories/GHSA-qpqv-xwg8-cqpj](https://github.com/open-webui/open-webui/security/advisories/GHSA-qpqv-xwg8-cqpj)
- [https://www.vulncheck.com/advisories/open-webui-0.6.33-before-0.11.4-stored-xss-via-citation-embed-url](https://www.vulncheck.com/advisories/open-webui-0.6.33-before-0.11.4-stored-xss-via-citation-embed-url)

## Related threats

- [Open WebUI stored cross-site scripting in Markdown renderer](https://junglewise.ai/threats/cve-2026-109300-open-webui-from-0-6-31-before-0-11-4-contains-a-stored-cross)
- [Open WebUI denial of service in recurrence rule validation](https://junglewise.ai/threats/cve-2026-109299-open-webui-from-0-9-0-before-0-11-4-contains-a-denial-of-service)
- [Open WebUI regex denial of service in file search tools](https://junglewise.ai/threats/cve-2026-109298-open-webui-0-11-0-before-0-11-4-compiles-user-chosen-grep)
- [Open WebUI automation recurrence-rule denial of service](https://junglewise.ai/threats/cve-2026-109297-open-webui-0-11-0-before-0-11-4-contains-a-denial-of-service)
- [Open WebUI missing authorization in model provider routes](https://junglewise.ai/threats/cve-2026-109296-open-webui-before-0-11-4-contains-a-missing-authorization)