CVE-2026-109288

6.4Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.4Medium

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: Required
Impact: High impact on confidentiality, integrity
Weakness: CWE-79

Impact

Authenticated attackers can steal other users' and admins' JWTs from local storage to hijack their sessions. To execute the attack, a user must click a malicious link embedded in a shared chat.

Root cause

The MarkdownInlineTokens.svelte component directly renders markdown link URLs into anchor href attributes without validating URL schemes, permitting javascript: URIs.

Affected systems

Open WebUI versions before 0.11.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade Open WebUI to version 0.11.4 or later. If updating immediately is not possible, restrict chat sharing or advise users not to click links within shared chats.

shell

$ docker pull ghcr.io/open-webui/open-webui:0.11.4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109288