CVE-2026-44721
High · 7.3CVSS
7.3
EPSS
0.4%
Published
May 15, 2026
CISA due date
—
The record
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspace.models) to execute arbitrary JavaScript in the browser of any other user (including admins) who views the malicious model in the chat UI. This vulnerability is fixed in 0.9.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | open-webui | 0 | 0.9.0 |
| npm | open-webui | 0 | 0.9.0 |
Related vulnerabilities
- GHSA-gf5m-wcrh-7928 open-webui Vulnerable to Stored XSS via Model Description Same vulnerability
- GHSA-c6xv-rcvw-v685 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing… Also affects open-webui
- CVE-2025-65958 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing… Also affects open-webui
- GHSA-frv8-gffc-37px open-webui is Vulnerable to Incorrect Access Control Also affects open-webui
- CVE-2025-63681 open-webui is Vulnerable to Incorrect Access Control Also affects open-webui
- GHSA-cm35-v4vp-5xvx Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via… Also affects open-webui
- GHSA-w7xj-8fx7-wfch Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is… Also affects open-webui
- CVE-2025-64496 Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via… Also affects open-webui