Is CVE-2026-109300 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109300 being exploited in the wild.

How severe is CVE-2026-109300?

Medium severity, with a CVSS score of 4.6, published 12 October 2026.

How is CVE-2026-109300 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109300?

Check whether you run Open WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109300: Open WebUI stored cross-site scripting in Markdown renderer

CVE-2026-109300 · Severity: medium · CVSS 4.6 · Published 2026-10-12

Open WebUI is a web-based interface for interacting with AI models. A stored cross-site scripting vulnerability allows authenticated users to inject malicious JavaScript into messages viewed by others, enabling phishing attacks or session hijacking. The vulnerability exists in how the application renders tool-call blocks in Markdown, treating user-authored content the same as trusted server output.

Technologies: Open WebUI. Vendors: Open WebUI.

Quick answers

Is CVE-2026-109300 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109300 being exploited in the wild.
How severe is CVE-2026-109300?: Medium severity, with a CVSS score of 4.6, published 12 October 2026.
Which products and versions are affected?: Open WebUI 0.6.31 to 0.11.3.
Is there a fix for CVE-2026-109300?: Yes: fixed in 0.11.4. Until then: Upgrade to version 0.11.4, which makes embed rendering opt-in and restricts it to trusted contexts only. Do not enable the iframeSandboxAllowSameOrigin configuration option unless necessary.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-27"},{"kind":"advisory","at":"2026-10-12"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109300 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109300?: Check whether you run Open WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.11.4

Upgrade to version 0.11.4, which makes embed rendering opt-in and restricts it to trusted contexts only. Do not enable the iframeSandboxAllowSameOrigin configuration option unless necessary.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-09-27"},{"kind":"advisory","at":"2026-10-12"}]

Technical details

The Markdown renderer in Open WebUI fails to distinguish user-authored tool-call detail blocks from server-generated tool output, parsing the embeds attribute and mounting its contents in script-enabled iframes. An authenticated attacker can craft malicious content in channel messages, direct messages, or citation previews that executes arbitrary JavaScript in viewers' browsers. By default, the injected script runs in a null-origin sandbox; when iframeSandboxAllowSameOrigin is enabled, it gains access to localStorage and can perform session hijacking.

Affected products

Open WebUI Open WebUI 0.6.31 to 0.11.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.