●PocketClawAI security alerts
Sign in
mediumCVSS 4.6NVD status: Received

CVE-2026-109300

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute...

ComponentOpen WebUI
Severitymedium (CVSS 4.6)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Published (NVD)2026-10-12
Affected versions
>= 0.6.31, < 0.11.4
read from the advisory text: NVD has not published CPE data yet
Fixed in0.11.4
WeaknessCWE-79
CISA KEVnot listed

NVD description

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that runs JavaScript in viewers' browsers, enabling in-app phishing, or session hijacking where iframeSandboxAllowSameOrigin is enabled.

Does CVE-2026-109300 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Open WebUI.
Check my stack

What to do

  • Upgrade Open WebUI to 0.11.4 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other Open WebUI CVEs

medium
CVE-2026-109288CVSS 6.4

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR...

Open WebUI
2026-10-12high
CVE-2026-109286CVSS 8.1

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea...

Open WebUI
2026-10-12medium
CVE-2026-109283CVSS 5.4

Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro...

Open WebUI
2026-10-12medium
CVE-2026-109284CVSS 4.3

Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in...

Open WebUI
2026-10-12medium
CVE-2026-109285CVSS 5

Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base...

Open WebUI
2026-10-12medium
CVE-2026-109287CVSS 4.3

Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir...

Open WebUI
2026-10-12

All Open WebUI CVEs