CVE Alert: CVE-2026-109291 – open-webui – open

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims’ sessions by storing javascript: URLs in citation embed_url fields. Attackers can a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

**Risk verdict:** High risk for deployments where low-privilege accounts can create or chats; KEV, exploitation-state and EPSS data were not provided, so urgency cannot be raised on those indicators.

**Why this matters:** A successful attack could expose a victim’s browser-held authentication token and enable actions as that user, potentially compromising sensitive conversations or connected workflows. The principal concern is account compromise and data access or manipulation, rather than service disruption; impact depends on the victim’s permissions.

**Most likely attack path:** An authenticated attacker stores a malicious citation URL in shared content, then relies on a victim opening the chat and activating the citation. Network access is sufficient, attack complexity is low, and no additional conditions are indicated; the attacker needs an account, while victim interaction is required. Scope is unchanged, suggesting impact is confined to the affected application’s authority, though a privileged victim could increase consequences.

**Who is most exposed:** Internet-accessible or broadly shared self-hosted deployments are most exposed, especially those with many user accounts or sensitive chat history.

Review citation `embed_url` values for `javascript:` schemes or other unexpected URL schemes.

Investigate unusual citation-link clicks followed by anomalous account activity.

Check for unexpected access to chat data or actions performed under affected accounts.

Mitigation and prioritisation

Upgrade promptly to the vendor-fixed release; confirm the running instance actually changed.

Temporarily restrict chat sharing and citation links where patching must wait.

Revoke sessions and rotate credentials for users with suspicious activity.

Obtain KEV, SSVC and EPSS status before final triage; if KEV is true or EPSS is at least 0.5, treat as priority 1.

Test the upgrade and controls in staging, then deploy through normal change management.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.