Open Webui 0.6.33 Before 0.11.4 Stored Xss Via Citation Embed Url

Back www.vulncheck.com

Open Webui 0.6.33 Before 0.11.4 Stored Xss Via Citation Embed Url

www.vulncheck.com • October 13, 2026

Share: View original

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

GitHub Security Advisory (GHSA-qpqv-xwg8-cqpj)

VulnCheck Advisory: Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-109291: Cross-Site Scripting Vulnerability in Open WebUI A cross-site scripting vulnerability (CVE-2026-109291) has been identified in Open WebUI versions 0.6.33 to 0.11.3, allowing authenticated users to execute scripts in victims' sessions. Attackers can store malicious 'javascript:' URLs in the embed_url field of chat citations, which, when clicked by victims, can lead to the theft of their localStorage.token. This vulnerability primarily affects deployments where low-privilege accounts can create chats. The risk is particularly high for self-hosted instances that are internet-accessible or widely shared. The flaw was disclosed on October 12, 2026, and a patch was released in version 0.11.4. Users are urged to upgrade promptly to mitigate the risk of account compromise and unauthorized data access. 1 sources 65

Extracted Entities

Attack Types (1)

Cross-site Scripting

CWE Weaknesses (1)

CWE-79 - Cross-site Scripting (xss)

Vulnerabilities (1)

Stored XSS Via Citation Embed URL