{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopenwebuiopen_webui0.3.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.4,"id":"CVE-2024-7990"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["open-webui (\u003c= 0.8.12)"],"_cs_severities":["high"],"_cs_tags":["xss","open-webui","web-application"],"_cs_type":"advisory","_cs_vendors":["npm","pip"],"content_html":"\u003cp\u003eOpen-WebUI versions v0.3.5 through v0.8.12 are susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with model creation permissions to inject malicious JavaScript code into the model description field. When other users, including administrators, view the affected model's description in the chat UI and click the specially crafted markdown link, the injected JavaScript code executes within their browsers. This can lead to session hijacking, sensitive data theft, or other unauthorized actions. The vulnerability stems from insufficient sanitization of user-supplied model descriptions before rendering them in the user interface. The issue is resolved in version v0.9.0. This vulnerability is distinct from CVE-2024-7990, as it leverages a different bypass mechanism involving markdown links with javascript: URIs.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker authenticates to the Open-WebUI instance with an account that has model creation permissions (workspace.models).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious model description containing a markdown link with a \u003ccode\u003ejavascript:\u003c/code\u003e URI (e.g., \u003ccode\u003e[text](javascript:alert())\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker uses the \u003ccode\u003e/api/v1/models/create\u003c/code\u003e endpoint to create a new model with the malicious description.\u003c/li\u003e\n\u003cli\u003eThe Open-WebUI application stores the unsanitized model description in the database.\u003c/li\u003e\n\u003cli\u003eA victim user (including an administrator) navigates to the chat UI and views the model with the malicious description.\u003c/li\u003e\n\u003cli\u003eThe application retrieves the model description from the database and renders it using \u003ccode\u003esanitizeResponseContent\u003c/code\u003e, \u003ccode\u003ereplaceAll('\\n', '\u0026lt;br\u0026gt;')\u003c/code\u003e, \u003ccode\u003emarked.parse()\u003c/code\u003e, and \u003ccode\u003e{@html ...}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emarked.parse()\u003c/code\u003e function converts the markdown link into an \u003ccode\u003e\u0026lt;a href=\u0026quot;javascript:...\u0026quot;\u0026gt;\u003c/code\u003e HTML element.\u003c/li\u003e\n\u003cli\u003eThe victim user clicks on the malicious link, triggering the execution of the JavaScript code within their browser. This could exfiltrate the user's access token via a crafted \u003ccode\u003ejavascript:\u003c/code\u003e url.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser. This can lead to a variety of malicious outcomes, including session hijacking, theft of sensitive information (such as access tokens), defacement of the user interface, and potentially, remote code execution if combined with other vulnerabilities. Given the ability to steal admin tokens, attackers can create new tools to execute arbitrary code, which impacts all Open-WebUI users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Open-WebUI to version v0.9.0 or later, where the output of \u003ccode\u003emarked.parse()\u003c/code\u003e is wrapped with \u003ccode\u003eDOMPurify.sanitize()\u003c/code\u003e to mitigate the XSS vulnerability.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Open-WebUI Model Creation with Javascript URI\u0026quot; to identify attempts to create models with malicious descriptions.\u003c/li\u003e\n\u003cli\u003eReview existing model descriptions for suspicious content, particularly markdown links with \u003ccode\u003ejavascript:\u003c/code\u003e URIs, and remove or sanitize any identified malicious entries.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-08T19:00:28Z","date_published":"2026-05-08T19:00:28Z","id":"https://feed.craftedsignal.io/briefs/2026-05-08-open-webui-xss/","summary":"Open-WebUI is vulnerable to stored cross-site scripting (XSS) where an authenticated user with model creation permissions can inject a malicious model description containing a javascript: URI within a markdown link that, when clicked, executes arbitrary JavaScript in another user's browser, potentially leading to session hijacking; this affects versions v0.3.5 through v0.8.12.","title":"Open-WebUI Stored XSS Vulnerability via Model Description","url":"https://feed.craftedsignal.io/briefs/2026-05-08-open-webui-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}