CVE-2026-109291: Open WebUI XSS Vulnerability

CVE-2026-109291 Overview

CVE-2026-109291 is a stored cross-site scripting (XSS) vulnerability in Open WebUI versions 0.6.33 through versions prior to 0.11.4. The flaw resides in the citation embed_url field, which fails to validate URL schemes before passing values to window.open. Authenticated users can store javascript: URLs inside crafted chats and share them with victims. When a victim clicks the citation, the attacker-controlled script executes in the victim's session context. The weakness is tracked as CWE-79.

Critical Impact
Successful exploitation allows attackers to steal localStorage.token and fully impersonate the victim within Open WebUI.

Affected Products

Open WebUI version 0.6.33
Open WebUI versions after 0.6.33 and before 0.11.4
Fixed in Open WebUI 0.11.4

Discovery Timeline

2026-10-12 - CVE-2026-109291 published to the National Vulnerability Database
2026-10-15 - CVE-2026-109291 last updated in NVD

Technical Details for CVE-2026-109291

Vulnerability Analysis

Open WebUI renders citations attached to chat responses and treats the embed_url property as a navigable link. The frontend passes this value directly to window.open when a user clicks the citation. Because the application does not restrict the URL scheme, a javascript: URI stored in embed_url is executed in the origin of the victim's Open WebUI session. The payload runs with the privileges of the authenticated viewer, including access to browser-scoped secrets such as the session token in localStorage.

Attackers exploit the issue by crafting a chat whose citation contains a malicious embed_url, then sharing that chat with other authenticated users. The attack requires user interaction, since the victim must click the citation, but no additional privileges beyond a standard authenticated account are needed to plant the payload.

Root Cause

The underlying defect is missing output validation on URL schemes. The citation rendering logic accepts arbitrary strings for embed_url and does not restrict navigation to safe schemes such as http: and https:. Passing a javascript: URL to window.open triggers script execution in the parent origin.

Attack Vector

Exploitation proceeds over the network against an authenticated Open WebUI instance. The attacker needs a low-privilege account to create and share a chat. When the victim opens the shared chat and clicks the poisoned citation, the attacker's JavaScript reads localStorage.token and exfiltrates it, enabling full session hijack and subsequent actions as the victim. See the GitHub Security Advisory GHSA-qpqv-xwg8-cqpj for the vendor's technical description.

Detection Methods for CVE-2026-109291

Indicators of Compromise

Citation records in chat payloads whose embed_url field begins with javascript:, data:, or other non-HTTP schemes.
Outbound browser requests to attacker-controlled hosts carrying values that match the structure of an Open WebUI session token.
Unexpected API activity performed under a legitimate user account shortly after that user viewed a shared chat.

Detection Strategies

Scan the Open WebUI database for citation objects containing scheme prefixes other than http:// or https:// in embed_url.
Inspect reverse proxy and application logs for shared-chat access patterns followed by anomalous authenticated API calls from new IP addresses or user agents.
Add Content Security Policy (CSP) violation monitoring to surface inline script execution attempts within the Open WebUI origin.

Monitoring Recommendations

Alert on session tokens appearing in URL query strings, POST bodies, or DNS queries leaving the environment.
Correlate chat-sharing events with downstream privileged actions by the recipient account.
Track Open WebUI version strings across deployments to confirm all instances are on 0.11.4 or later.

How to Mitigate CVE-2026-109291

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.11.4 or later without delay.
Invalidate existing user sessions and rotate API tokens after upgrading to defeat any tokens already stolen.
Audit stored chats and citation records for embed_url values containing javascript: or other dangerous schemes and remove them.

Patch Information

The maintainers fixed CVE-2026-109291 in Open WebUI 0.11.4. The fix validates the URL scheme of citation embed_url values before they are passed to window.open. Review the GitHub Security Advisory GHSA-qpqv-xwg8-cqpj and the VulnCheck advisory for Open WebUI XSS for release details.

Workarounds

Restrict chat sharing to trusted users until the upgrade completes.
Deploy a strict Content Security Policy that blocks inline scripts and javascript: navigations within the Open WebUI origin.
Place Open WebUI behind an authenticating reverse proxy and limit account provisioning to vetted users.

bash

# Upgrade Open WebUI container to a fixed release
docker pull ghcr.io/open-webui/open-webui:0.11.4
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.4