Executive brief
Open WebUI is a self-hosted interface for interacting with artificial intelligence models. A security flaw allows an attacker to embed malicious code within Markdown files that, when viewed by another user, can execute commands in that user's browser. This could lead to unauthorized access to user data, session hijacking, or the performance of actions on behalf of the victim within the platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Open WebUI's file preview component. The application renders Mermaid diagram blocks from Markdown files and injects the resulting SVG directly into the DOM using 'innerHTML'. Because the Mermaid library is configured with 'securityLevel: loose', it does not sufficiently sanitize the output. An attacker with low privileges can upload a malicious .md file; when a victim previews this file, the attacker-controlled JavaScript executes under the application's origin. This issue is fixed in version 0.9.6 by transitioning to a stricter security configuration.
Affected products
- Open WebUI Open WebUI < 0.9.6
Timeline
- 2026-06-11: advisory: GitHub security advisory published
- 2026-06-23: disclosed: NVD publication date