Stored Cross-Site Scripting Vulnerability in Open-WebUI by Open-WebUI
CVE-2024-7990
8.4HIGH
What is CVE-2024-7990?
A stored cross-site scripting (XSS) vulnerability exists in Open-WebUI version 0.3.8, specifically within the '/api/v1/models/add' endpoint. The model description field is not properly sanitized prior to being displayed in chat, allowing attackers to inject malicious scripts. This flaw could be exploited by attackers to execute harmful scripts on the browsers of users—including administrators—potentially enabling them to carry out arbitrary code execution.
Affected Version(s)
open-webui/open-webui <= unspecified