CVE-2026-109291: Cross-Site Scripting Vulnerability in Open WebUI
Article Content
- •CVE-2026-109291 allows attackers to execute scripts via malicious chat citations.
- •The vulnerability affects Open WebUI versions 0.6.33 to 0.11.3 and was patched in 0.11.4.
- •Self-hosted deployments with low-privilege accounts are most at risk.
A cross-site scripting vulnerability (CVE-2026-109291) has been identified in Open WebUI versions 0.6.33 to 0.11.3, allowing authenticated users to execute scripts in victims' sessions. Attackers can store malicious 'javascript:' URLs in the embed_url field of chat citations, which, when clicked by victims, can lead to the theft of their localStorage.token. This vulnerability primarily affects deployments where low-privilege accounts can create chats. The risk is particularly high for self-hosted instances that are internet-accessible or widely shared. The flaw was disclosed on October 12, 2026, and a patch was released in version 0.11.4. Users are urged to upgrade promptly to mitigate the risk of account compromise and unauthorized data access.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track CVE-2026-109291 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions are affected?
Is there a patch available?
What should I do if I can't upgrade immediately?
Continue Reading
Twitch Chat Messages Exploit OBS Studio via Chromium Vulnerability A vulnerability in OBS Studio allows malicious Twitch chat messages to execute native code on streamers' Windows PCs. This exploit targets users running OBS Studio version 32.2.2 or older, leveraging a cross-site scripting (XSS) flaw in custom overlays that render viewer messages as unsanitized HTML. The attack…