Executive brief
Open WebUI, a popular interface for interacting with large language models, contains a security flaw that allows users to inject malicious scripts into chat messages. By sharing a compromised chat link, an attacker can steal login tokens from other users or potentially gain control over the server if an administrator views the link. This could lead to unauthorized access to sensitive data or a complete takeover of the application.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Open WebUI due to improper neutralization of the 'embeds' property in chat response messages. An attacker can manually modify chat history via an intercepted request to include a malicious payload in the 'embeds' field. The application renders this content in an iFrame with 'allow-scripts' and 'allow-same-origin' hardcoded in the sandbox attribute, bypassing security configurations. This allows for session token exfiltration from local storage. If an administrator is targeted, this can be chained with other vulnerabilities to achieve Remote Code Execution (RCE). The issue is patched in version 0.6.44.
Affected products
- Open WebUI open-webui <= 0.6.43
Timeline
- 2026-02-17: disclosed
- 2026-02-19: advisory: NVD publication date
- 2026-07-07: patched: GitHub Advisory published and reviewed