Securaity Browse advisories
SA-26-087 High

Open WebUI: Open WebUI has stored XSS via the HTML renedering view

Open WebUI

More for Open WebUI RSS feed for Open WebUI

Severity
High, CVSS 7.7
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Record
CVE-2026-45303
Affects
Open WebUI
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
May 15, 2026
Source last modified
June 17, 2026

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and executed. The frontend provides a function to visualize the HTML content of a current chat. The content is embedded in an iFrame with the allow-scripts allow-forms allow-same-origin sandbox directive. This means that the content is placed in a sandbox but with permission to execute scripts and access the parent’s data (e.g., local storage). As a result, only a few functions are restricted (e.g., displaying an alert box), but in effect, the sandbox attribute is largely nullified. This vulnerability is fixed in 0.6.5.

Description quoted from the NVD record.

Who is affected

Open WebUI is a chat program for working with artificial intelligence that your organization runs on its own computers, and it can work entirely offline. This flaw affects versions before 0.6.5. The problem is in the feature that shows a preview of web page content from a chat. Harmful scripts can be placed in a chat and then run when that preview is shown, and those scripts can reach data the program keeps in the user's web browser. Safety limits meant to contain that preview are largely ineffective. This flaw is rated High.

What to do

  1. Find out who runs Open WebUI for your organization: the person who installed it, or the IT provider or vendor who manages it.
  2. If your organization runs it itself, have that person update Open WebUI to version 0.6.5 or later, which fixes this flaw.
  3. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
  4. After the update, check that every copy of Open WebUI your organization uses shows version 0.6.5 or later.

Analysis written from the source record as of June 17, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all