Open WebUI: open-webui Vulnerable to Stored XSS via Model Description
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- High, CVSS 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- Record
- CVE-2026-44721
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 15, 2026
- Source last modified
- June 17, 2026
Description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspace.models) to execute arbitrary JavaScript in the browser of any other user (including admins) who views the malicious model in the chat UI. This vulnerability is fixed in 0.9.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a chat program for AI language models that an organization runs on its own computers, and it can work entirely offline. This flaw affects versions before 0.9.0. Any signed-in user who has permission to create models can set up a harmful model that runs code of their choosing in the web browser of anyone else who views that model in the chat screen, including administrators. This flaw is rated High.
What to do
- If someone in your organization installed or runs Open WebUI, ask them to update it to version
0.9.0or later, which fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
- Ask whoever manages Open WebUI which accounts have permission to create models, because those accounts are the ones that could misuse this flaw.
- Once the update is done, ask them to check that Open WebUI shows version
0.9.0or later.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.