CVE-2026-109300 Overview
CVE-2026-109300 is a stored cross-site scripting (XSS) vulnerability in Open WebUI versions 0.6.31 through 0.11.3. The flaw lives in the Markdown renderer, which treats user-authored tool-call details blocks as trusted tool output. The renderer mounts the embeds attribute inside script-enabled iframes. Authenticated users can post crafted channel messages, chat messages, or citation content that executes JavaScript in viewers' browsers. The issue is tracked under CWE-79.
Critical Impact
Attackers with authenticated access can achieve in-app phishing and, when iframeSandboxAllowSameOrigin is enabled, session hijacking against other users of the Open WebUI instance.
Affected Products
- Open WebUI versions 0.6.31 and later
- Open WebUI versions prior to 0.11.4
- Deployments with iframeSandboxAllowSameOrigin enabled (elevated impact)
Discovery Timeline
- 2026-10-12 - CVE-2026-109300 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109300
Vulnerability Analysis
Open WebUI renders assistant tool-call output through a Markdown pipeline that includes a details block for tool invocations. The renderer assumes these blocks originate from backend tool execution and are therefore safe. In practice, the renderer accepts the same details syntax when authored directly by a user in a channel message, chat message, or citation payload.
When the renderer encounters the embeds attribute on these blocks, it instantiates an iframe with scripting permitted. Attacker-controlled HTML inside embeds executes within the viewer's authenticated Open WebUI session.
The impact depends on iframe sandbox configuration. With default sandboxing, attackers can run arbitrary scripts for phishing overlays and user-interface spoofing. When administrators enable iframeSandboxAllowSameOrigin, the iframe shares the parent origin, allowing access to session cookies, local storage, and authenticated API calls.
Root Cause
The root cause is improper neutralization of input during web page generation. The Markdown renderer applies a trust decision based on block type rather than input provenance. User-submitted content is treated identically to backend tool output, bypassing the sanitization that would otherwise strip executable embeds.
Attack Vector
An authenticated attacker crafts a message, channel post, or citation containing a tool-call details block with a malicious embeds attribute. Any user who renders the attacker's content loads the iframe and executes the attacker's JavaScript. User interaction is required to view the poisoned content. No elevated privileges beyond standard authenticated access are needed to post the payload.
Technical details are documented in the GitHub Security Advisory GHSA-9wj4-mcm3-ppj6 and the VulnCheck Advisory for Open WebUI XSS.
Detection Methods for CVE-2026-109300
Indicators of Compromise
- Stored chat, channel, or citation records containing details blocks with an embeds attribute authored by non-service accounts.
- Outbound requests from user browsers to unexpected third-party domains originating from Open WebUI iframe contexts.
- Unexpected session token activity or API calls shortly after a user views a specific chat or channel.
Detection Strategies
- Review the Open WebUI message store for Markdown content containing <details, tool_call, and embeds attributes that did not originate from backend tool execution.
- Deploy a Content Security Policy (CSP) report-only header to surface inline script execution attempts within rendered chat views.
- Monitor browser telemetry for iframe creation events pointing to the Open WebUI origin where content is user-authored.
Monitoring Recommendations
- Alert on new or modified messages that embed iframe-capable markup from accounts outside of the service-account allowlist.
- Track authentication anomalies such as concurrent sessions or geographic shifts following user interaction with suspect messages.
- Correlate web proxy logs with Open WebUI access logs to identify data exfiltration callbacks from rendered pages.
How to Mitigate CVE-2026-109300
Immediate Actions Required
- Upgrade Open WebUI to version 0.11.4 or later on all deployments.
- Disable iframeSandboxAllowSameOrigin until the upgrade is complete and verified.
- Audit existing chat, channel, and citation records for malicious details blocks and purge offending entries.
- Rotate session tokens and API keys for users who may have viewed attacker-controlled content.
Patch Information
Open WebUI version 0.11.4 resolves CVE-2026-109300 by preventing user-authored tool-call details blocks from being treated as trusted tool output. Review the GitHub Security Advisory GHSA-9wj4-mcm3-ppj6 for upgrade guidance and release notes.
Workarounds
- Restrict Open WebUI access to trusted authenticated users while upgrade planning is underway.
- Set iframeSandboxAllowSameOrigin to disabled to prevent same-origin script execution within rendered iframes.
- Enforce a strict Content Security Policy that blocks inline scripts and limits iframe sources to known trusted origins.
# Configuration example - disable same-origin iframe sandbox and pin to patched version
export IFRAME_SANDBOX_ALLOW_SAME_ORIGIN=false
pip install --upgrade "open-webui>=0.11.4"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
