CVE-2026-109300: Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Q: Who can exploit this issue and who is exposed to the resulting script execution?

An authenticated Open WebUI user can submit crafted content through channel messages, chat messages, or citation content. Users who view that stored content may have JavaScript executed in their browsers.

Q: What configuration increases the impact of exploitation?

Session hijacking is possible where iframeSandboxAllowSameOrigin is enabled. The issue otherwise enables in-application phishing through JavaScript executed in a viewer's browser.

Q: Which releases are affected?

Open WebUI versions from 0.6.31 up to, but not including, 0.11.4 are affected.

Published Oct 12, 2026

Updated

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.

Affected Software

1 affected component

Open WebUI Open WebUI>=0.6.31<0.11.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Open WebUI to a version that resolves this vulnerability.
Fixed in 0.11.4

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue and who is exposed to the resulting script execution?

An authenticated Open WebUI user can submit crafted content through channel messages, chat messages, or citation content. Users who view that stored content may have JavaScript executed in their browsers.

What configuration increases the impact of exploitation?

Session hijacking is possible where iframeSandboxAllowSameOrigin is enabled. The issue otherwise enables in-application phishing through JavaScript executed in a viewer's browser.

Which releases are affected?

Open WebUI versions from 0.6.31 up to, but not including, 0.11.4 are affected.

CVE-2026-109300: Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue and who is exposed to the resulting script execution?

What configuration increases the impact of exploitation?

Which releases are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue and who is exposed to the resulting script execution?

What configuration increases the impact of exploitation?

Which releases are affected?