CVE-2026-109288 Overview
CVE-2026-109288 is a stored cross-site scripting (XSS) vulnerability in Open WebUI versions prior to 0.11.4. The flaw resides in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor href attributes without validating the URL scheme. Authenticated users can embed javascript: URIs inside shared chats. When a victim clicks the crafted link, the attacker's script executes in the victim's browser context and exfiltrates the JSON Web Token (JWT) stored in local storage. Because administrators who review shared chats can also be targeted, attackers can escalate from a low-privileged account to full administrative access over the Open WebUI instance [CWE-79].
Critical Impact
An authenticated attacker can steal admin JWT tokens from local storage and take over the Open WebUI instance.
Affected Products
- Open WebUI versions prior to 0.11.4
- MarkdownInlineTokens.svelte rendering component
- Shared chat feature exposed to any authenticated user
Discovery Timeline
- 2026-10-12 - CVE-2026-109288 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-109288
Vulnerability Analysis
Open WebUI renders user-authored chat content using a Svelte component, MarkdownInlineTokens.svelte, which converts markdown link tokens into HTML anchor elements. The component writes the token's URL directly into the anchor's href attribute. It does not restrict the URL to safe schemes such as http, https, or mailto.
Attackers abuse this gap by authoring markdown links of the form [text](javascript:...). When the markdown is persisted in a shared chat and later rendered in a victim's browser, the anchor retains the dangerous scheme. A click triggers script execution under the Open WebUI origin.
The payload reads the victim's JWT from localStorage and transmits it to an attacker-controlled endpoint. Because administrators frequently inspect shared chats to moderate content, their session tokens are reachable. A stolen admin JWT grants full API access, allowing model changes, user management, and data exfiltration.
Root Cause
The root cause is missing URL scheme allowlisting during markdown-to-HTML conversion. The renderer trusts arbitrary user input placed inside link syntax and emits it verbatim into the DOM, enabling script-URL injection [CWE-79].
Attack Vector
Exploitation requires an authenticated account with permission to create or share chats, and a victim interaction (clicking the link). The attacker crafts a markdown link whose target URL begins with javascript: and shares the chat. Any authenticated viewer who clicks the link executes the embedded script, including administrators.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-wf9m-46cp-c6h6 and the VulnCheck Open WebUI XSS Advisory for additional technical context.
Detection Methods for CVE-2026-109288
Indicators of Compromise
- Shared chat records containing markdown links with href values beginning with javascript:, data:, or vbscript:.
- Outbound HTTP requests from browsers viewing Open WebUI pages to unexpected domains carrying JWT-shaped bearer tokens.
- Admin API calls originating from IP addresses or user agents not associated with normal administrator activity.
- Unexplained changes to users, API keys, or model configurations shortly after an admin viewed a shared chat.
Detection Strategies
- Inspect the Open WebUI database for stored chat content matching the regex \]\(\s*javascript: or similar scheme-smuggling patterns.
- Enable Content Security Policy (CSP) violation reporting and alert on script-src violations originating from Open WebUI routes.
- Correlate browser error telemetry with admin session activity to flag unexpected script execution within the Open WebUI origin.
Monitoring Recommendations
- Monitor administrator JWT usage for geographic or client-fingerprint anomalies.
- Log and review all shared-chat creation events, especially those authored by newly created or low-trust accounts.
- Track changes to Open WebUI administrative settings and user roles for post-exploitation activity.
How to Mitigate CVE-2026-109288
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.4 or later across all deployments.
- Invalidate existing sessions and rotate all administrator JWTs after upgrading.
- Audit shared chats created before the upgrade for malicious markdown links and remove affected content.
- Review admin audit logs for suspicious configuration or user changes that could indicate token theft.
Patch Information
The maintainers addressed CVE-2026-109288 in Open WebUI 0.11.4 by validating URL schemes rendered by MarkdownInlineTokens.svelte. See the GitHub Security Advisory GHSA-wf9m-46cp-c6h6 for the fix commit and release notes.
Workarounds
- Restrict chat sharing to trusted users until the upgrade is deployed.
- Deploy a strict Content Security Policy that forbids inline script execution and javascript: URIs for the Open WebUI origin.
- Move JWT storage out of localStorage where possible, or shorten token lifetimes to reduce the window of theft.
- Place Open WebUI behind an authenticating reverse proxy that strips or rewrites dangerous URL schemes in cached responses.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
