CVE-2025-65959
High · 8.7CVSS
8.7
EPSS
0.2%
Published
Dec 4, 2025
CISA due date
—
The record
Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF'
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | open-webui | 0 | 0.6.37 |
Related vulnerabilities
- GHSA-8wvc-869r-xfqf Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF' Same vulnerability
- CVE-2026-45346 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-45665 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-45395 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-44721 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- GHSA-cqp4-qqvg-3787 Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order Also affects open-webui
- GHSA-p4fx-23fq-jfg6 Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows… Also affects open-webui
- GHSA-r29h-37fj-x2w6 Open WebUI Has Stored Cross-Site Scripting in SVG Renderer Also affects open-webui