# CVE-2026-44721: Open WebUI stored XSS in model description

Source: https://junglewise.ai/threats/cve-2026-44721-open-webui-stored-xss-in-model-description  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-16  
License: CC BY 4.0 with a link back

CVE-2026-44721 · Severity: high · CVSS 7.3 · Published 2026-05-15

Open WebUI is an interface for interacting with large language models. A security flaw allows users with model-creation permissions to embed malicious code within a model's description. If another user, such as an administrator, views this model and clicks a link in the description, the attacker can steal their login session, potentially leading to full account takeover and unauthorized access to the system.

Technologies: [open-webui (npm)](https://junglewise.ai/threats/technologies/npm-open-webui), [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-44721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44721 being exploited in the wild.

**How severe is CVE-2026-44721?** High severity, with a CVSS score of 7.3, published 15 May 2026.

**Which products and versions are affected?** open-webui (npm) SEMVER:introduced=0,fixed=0.9.0; open-webui (PyPI) <= 0.8.12, ECOSYSTEM:introduced=0,fixed=0.9.0.

**Is there a fix for CVE-2026-44721?** Yes. open-webui (npm): upgrade to 0.9.0 or later; open-webui (PyPI): upgrade to 0.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44721 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44721?** Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-webui (npm): upgrade to 0.9.0 or later

  ```sh
  npm install open-webui@0.9.0
  ```

- open-webui (PyPI): upgrade to 0.9.0 or later

  ```sh
  pip install "open-webui>=0.9.0"
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Open WebUI due to a pipeline-ordering flaw in how model descriptions are rendered. The application passes the description through a custom 'sanitizeResponseContent' function (which only escapes angle brackets) and then through 'marked.parse()' before rendering it via Svelte's '{@html}' directive. An attacker can use markdown link syntax with a 'javascript:' URI, which bypasses the initial sanitization and is converted into a functional anchor tag by the markdown parser. When a victim clicks the resulting link, the malicious script executes, allowing for LocalStorage token theft. The issue is fixed in version 0.9.0 by wrapping the markdown output in DOMPurify.sanitize().

## Affected products

- open-webui open-webui >= 0.3.5, <= 0.8.12

## Identifiers

- CVE-2026-44721
- GHSA-gf5m-wcrh-7928
- PYSEC-2026-2725

## Timeline

- 2026-05-04: disclosed
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-15: kev added: NVD publication date

## References

- [https://api.github.com/users/fr0stydev](https://api.github.com/users/fr0stydev)
- [https://github.com/fr0stydev](https://github.com/fr0stydev)
- [https://api.github.com/users/fr0stydev/gists%7B/gist_id%7D](https://api.github.com/users/fr0stydev/gists%7B/gist_id%7D)
- [https://api.github.com/users/fr0stydev/repos](https://api.github.com/users/fr0stydev/repos)
- [https://avatars.githubusercontent.com/u/40015226?v=4](https://avatars.githubusercontent.com/u/40015226?v=4)
- [https://api.github.com/users/fr0stydev/events%7B/privacy%7D](https://api.github.com/users/fr0stydev/events%7B/privacy%7D)

## Related threats

- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88006-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88005-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI infinite loop denial of service in chat history reconstruction](https://junglewise.ai/threats/cve-2026-88002-open-webui-infinite-loop-denial-of-service-in-chat-history)
- [Open WebUI server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-88001-open-webui-server-side-request-forgery-via-unvalidated-http)
- [Open WebUI denial of service via cyclic chat tree message deletion](https://junglewise.ai/threats/cve-2026-88000-open-webui-denial-of-service-via-cyclic-chat-tree-message)