GHSA-8wvc-869r-xfqf
High · 8.7CVSS
8.7
EPSS
—
Published
Dec 4, 2025
CISA due date
—
The record
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | open-webui | 0 | 0.6.37 |
Related vulnerabilities
- CVE-2025-65959 Open WebUI vulnerable to Stored DOM XSS via Note 'Download PDF' Same vulnerability
- CVE-2026-45346 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-45665 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-45395 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- CVE-2026-44721 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- GHSA-cqp4-qqvg-3787 Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order Also affects open-webui
- GHSA-p4fx-23fq-jfg6 Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows… Also affects open-webui
- GHSA-r29h-37fj-x2w6 Open WebUI Has Stored Cross-Site Scripting in SVG Renderer Also affects open-webui