Stored Cross-Site Scripting Vulnerability in Open WebUI by Open WebUI
CVE-2026-109288

7.2HIGH

Key Information:

Vendor

Open-webui

Status
Open-webui
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109288?

Open WebUI versions prior to 0.11.4 are susceptible to a stored cross-site scripting vulnerability in the MarkdownInlineTokens.svelte component. The flaw arises from the application's failure to validate the scheme of markdown link URLs before rendering them as anchor hrefs. This vulnerability permits authenticated users to include malicious javascript: links in shared chats. When non-privileged users click these links, it can lead to unauthorized access to their JSON Web Tokens (JWT) stored in local storage, potentially compromising sensitive information, including administrator tokens.

Affected Version(s)

open-webui 0 < 0.11.4

open-webui 0.11.4

References

https://github.com/open-webui/open-webui/security/advisor...
vendor-advisory
https://www.vulncheck.com/advisories/open-webui-before-0....
third-party-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

r20z19
Classic298
.