CVE-2025-46719: Open WebUI XSS Vulnerability

CVE-2025-46719 Overview

CVE-2025-46719 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Open WebUI, a self-hosted AI platform designed to run offline. Versions prior to 0.6.6 improperly render certain HTML tags in chat messages, allowing attackers to inject JavaScript into chat transcripts. The injected script executes in the browser of any user who opens the transcript, exposing access tokens and enabling full account takeover. Shared transcripts and community-shared chats extend the blast radius across server users and, when Community Sharing is enabled, to openwebui.com.

Critical Impact
Exploitation against an administrator escalates to Remote Code Execution on the Open WebUI backend by creating a malicious Python function. The flaw is also wormable through community-shared chats hosted on openwebui.com.

Affected Products

Open WebUI versions prior to 0.6.6
Self-hosted Open WebUI deployments rendering chat markdown/HTML
Chat transcripts published to https://openwebui.com/c/<user>/<chat_id>

Discovery Timeline

2025-05-05 - CVE-2025-46719 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46719

Vulnerability Analysis

Open WebUI renders assistant and user chat messages through a Svelte-based Markdown pipeline. Prior to version 0.6.6, the MarkdownTokens.svelte component passed HTML tokens directly to the DOM without sanitization. An attacker crafting a chat message containing HTML tags with event handlers or <script>-equivalent constructs achieves JavaScript execution in the victim's session context.

Because chat transcripts persist server-side and can be shared with other users on the same instance, the payload behaves as stored XSS. When Enable Community Sharing is active, transcripts uploaded to openwebui.com propagate the payload beyond the local deployment, creating a wormable delivery vector against any visitor who opens the shared chat.

Against an administrator, the payload can call the authenticated API to register a new backend function containing arbitrary Python code, converting session-level XSS into Remote Code Execution on the host running the Open WebUI backend.

Root Cause

The root cause is missing output sanitization in the HTML token branch of the Markdown renderer. The pre-patch code accepted raw HTML tokens produced by marked and rendered them via Svelte's {@html} directive without passing them through a sanitizer such as DOMPurify.

Attack Vector

Exploitation requires the attacker to place a payload into a chat transcript that a victim subsequently views. Delivery paths include direct message sharing, transcript sharing between users on the same server, and community-shared chats on openwebui.com. User interaction is limited to opening the transcript.

text

// Security patch: src/lib/components/chat/Messages/Markdown/HTMLToken.svelte
<script lang="ts">
	import DOMPurify from 'dompurify';
	import type { Token } from 'marked';

	import { WEBUI_BASE_URL } from '$lib/constants';
	import Source from './Source.svelte';

	export let id: string;
	export let token: Token;

	export let onSourceClick: Function = () => {};

	let html: string | null = null;

	$: if (token.type === 'html' && token?.text) {
		html = DOMPurify.sanitize(token.text);
	} else {
		html = null;
	}
</script>

{#if token.type === 'html'}
	{#if html && html.includes('<video')}
		{@html html}
	{:else if token.text && token.text.match(/<iframe\s+[^>]*src="https:\/\/www\.youtube\.com\/embed\/([a-zA-Z0-9_-]{11})"[^>]*><\/iframe>/)}
		{@const match = token.text.match(
			/<iframe\s+[^>]*src="https:\/\/www\.youtube\.com\/embed\/([a-zA-Z0-9_-]{11})"[^>]*><\/iframe>/
		)}
		{@const ytId = match && match[1]}

Source: Open WebUI commit 6fd082d

The patch introduces a new HTMLToken.svelte component that routes all HTML tokens through DOMPurify.sanitize() before rendering. Only a narrow allowlist (sanitized <video> and YouTube embed iframes matching a strict regex) reaches the DOM.

Detection Methods for CVE-2025-46719

Indicators of Compromise

Chat transcript records in the Open WebUI database containing HTML tags such as <img onerror=, <svg onload=, or inline event handlers within the message body.
Creation of new backend functions in the admin Functions interface containing outbound network calls, os.system, subprocess, or exec constructs.
Unexpected requests from user browsers to attacker-controlled hosts immediately after opening a shared chat transcript.

Detection Strategies

Inspect stored chat messages for HTML that would be stripped by DOMPurify, focusing on event-handler attributes and non-allowlisted tags.
Audit administrator activity for function creation or modification events that do not correspond to a known change ticket.
Monitor egress from the Open WebUI backend host for connections to unfamiliar destinations following function execution.

Monitoring Recommendations

Enable web server access logging for the /api/v1/functions/* and chat-sharing endpoints and alert on anomalous POSTs.
Log all admin authentication events and correlate them with function-management API calls.
Track the Enable Community Sharing setting and alert if it is turned on outside of an approved change window.

How to Mitigate CVE-2025-46719

Immediate Actions Required

Upgrade Open WebUI to version 0.6.6 or later on every self-hosted instance.
Rotate all user access tokens and admin credentials, since token theft is the primary XSS impact.
Review the backend Functions list and remove any function that cannot be attributed to a legitimate change.
Audit shared chat transcripts, including any published to openwebui.com/c/<user>/<chat_id>, and remove suspicious entries.

Patch Information

Open WebUI 0.6.6 contains the fix, introduced in commit 6fd082d55ffaf6eb226efdeebc7155e3693d2d01. Refer to the GitHub Security Advisory GHSA-9f4f-jv96-8766 and the patch commit for details. The patch adds a dedicated HTMLToken.svelte component that sanitizes HTML tokens with DOMPurify and restricts rendering to an allowlist of <video> and YouTube embed iframes.

Workarounds

Disable Enable Community Sharing in the admin panel to prevent transcript propagation to openwebui.com.
Restrict chat sharing between users on multi-tenant deployments until the upgrade is applied.
Place Open WebUI behind a reverse proxy that enforces a strict Content-Security-Policy prohibiting inline scripts and unknown script sources.

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.6.6
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.6.6

# Verify installed version
curl -s http://localhost:3000/api/version