CVE-2026-44721: Open WebUI stored XSS in model description

CVE-2026-44721 · Severity: high · CVSS 7.3 · Published 2026-05-15

Open WebUI is an interface for interacting with large language models. A security flaw allows users with model-creation permissions to embed malicious code within a model's description. If another user, such as an administrator, views this model and clicks a link in the description, the attacker can steal their login session, potentially leading to full account takeover and unauthorized access to the system.

Technologies: open-webui (npm), open-webui (PyPI). Vendors: npm, PyPI.

Quick answers

Is CVE-2026-44721 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44721 being exploited in the wild.
How severe is CVE-2026-44721?
High severity, with a CVSS score of 7.3, published 15 May 2026.
Which products and versions are affected?
open-webui (npm) SEMVER:introduced=0,fixed=0.9.0; open-webui (PyPI) <= 0.8.12, ECOSYSTEM:introduced=0,fixed=0.9.0.
Is there a fix for CVE-2026-44721?
Yes. open-webui (npm): upgrade to 0.9.0 or later; open-webui (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44721 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44721?
Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (npm): upgrade to 0.9.0 or later
    npm install open-webui@0.9.0
  • open-webui (PyPI): upgrade to 0.9.0 or later
    pip install "open-webui>=0.9.0"

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Open WebUI due to a pipeline-ordering flaw in how model descriptions are rendered. The application passes the description through a custom 'sanitizeResponseContent' function (which only escapes angle brackets) and then through 'marked.parse()' before rendering it via Svelte's '{@html}' directive. An attacker can use markdown link syntax with a 'javascript:' URI, which bypasses the initial sanitization and is converted into a functional anchor tag by the markdown parser. When a victim clicks the resulting link, the malicious script executes, allowing for LocalStorage token theft. The issue is fixed in version 0.9.0 by wrapping the markdown output in DOMPurify.sanitize().

Affected products

  • open-webui open-webui >= 0.3.5, <= 0.8.12

Identifiers

  • CVE-2026-44721
  • GHSA-gf5m-wcrh-7928
  • PYSEC-2026-2725

Timeline

  • 2026-05-04: disclosed
  • 2026-05-08: advisory: GitHub Advisory published
  • 2026-05-15: kev added: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.