CVE-2026-109300

4.6Medium

Published 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

4.6Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can run arbitrary JavaScript in victims' browsers to perform in-app phishing or hijack sessions if iframeSandboxAllowSameOrigin is enabled. The attacker needs an account to post malicious chat messages, channel messages, or citations that another user must view.

Root cause

The Markdown renderer treats user-authored tool-call details blocks as trusted tool output and renders their embeds attribute inside script-enabled iframes.

Affected systems

Open WebUI from 0.6.31 before 0.11.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade Open WebUI to version 0.11.4 or higher. If patching immediately is not possible, disable the iframeSandboxAllowSameOrigin setting to prevent session hijacking.

shell

$ pip install --upgrade open-webui>=0.11.4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109300