CVE-2026-45318: Open WebUI XSS Vulnerability

CVE-2026-45318 Overview

CVE-2026-45318 is a stored cross-site scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw is a regression of CVE-2026-44549, where the original fix for an Excel-preview XSS was reverted sometime after version 0.8.0. The vulnerability resides in the Excel file preview feature, which renders untrusted spreadsheet content as HTML without sanitization. Attackers with low-privilege access can upload a malicious XLSX file that executes arbitrary JavaScript in the browser of any user previewing it. The issue is fixed in version 0.9.3.

Critical Impact
Authenticated attackers can inject arbitrary JavaScript through malicious Excel uploads, leading to session theft, account compromise, and unauthorized actions performed in the context of other Open WebUI users.

Affected Products

Open WebUI versions after 0.8.0 and prior to 0.9.3
Self-hosted Open WebUI deployments with Excel file preview enabled
Multi-user Open WebUI instances allowing file uploads

Discovery Timeline

2026-05-15 - CVE-2026-45318 published to the National Vulnerability Database
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-45318

Vulnerability Analysis

The vulnerability is a classic stored XSS [CWE-79] resulting from rendering untrusted HTML without sanitization. Open WebUI's Excel preview feature parses uploaded XLSX files using the SheetJS library and converts worksheet contents into HTML markup. The generated markup is then injected directly into the Svelte template using the {@html excelHtml} directive, which bypasses Svelte's default HTML escaping.

The vulnerability requires an authenticated user to upload a crafted Excel file and another user to preview it. Because the scope is changed (S:C), the injected script executes in the trusted Open WebUI origin and can access tokens, conversation history, and administrative endpoints accessible to the victim.

Root Cause

The root cause is the use of XLSX.utils.sheet_to_html() output passed to {@html excelHtml} without filtering through DOMPurify or an equivalent sanitizer. SheetJS preserves embedded HTML markup, including <script> tags, event handlers, and javascript: URIs from cell values, shared strings, and hyperlink targets. The original CVE-2026-44549 patch introduced sanitization, but a later commit reintroduced the unsanitized rendering path.

Attack Vector

An attacker authenticated to an Open WebUI instance crafts an XLSX file containing JavaScript payloads in cell values, formulas, or hyperlink fields. The file is uploaded through the standard document interface. When another user, including an administrator, opens the file for preview, the malicious markup is rendered as live HTML and the embedded script executes in the victim's browser session.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-hcwp-82g6-8wxc. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-45318

Indicators of Compromise

Uploaded XLSX files containing <script>, onerror, onload, or javascript: strings within cell values or shared strings XML
Unexpected outbound HTTP requests from browser sessions immediately after a user previews an uploaded spreadsheet
Sudden creation of new API keys, admin accounts, or model configuration changes following file preview events

Detection Strategies

Scan uploaded .xlsx files in storage for HTML or script content using YARA rules or static inspection of the unzipped XML parts
Monitor browser-side Content Security Policy (CSP) violation reports for inline script execution on Open WebUI preview pages
Review web server access logs for sequences of XLSX uploads followed by preview requests from different user sessions

Monitoring Recommendations

Enable audit logging for all file upload and preview events with user attribution and file hashes
Alert on Open WebUI deployments running versions between 0.8.0 and 0.9.3 detected through vulnerability scanning
Track outbound HTTP requests originating from authenticated Open WebUI browser sessions to non-allowlisted domains

How to Mitigate CVE-2026-45318

Immediate Actions Required

Upgrade Open WebUI to version 0.9.3 or later, which restores DOMPurify sanitization of the Excel preview output
Audit all uploaded XLSX files for embedded HTML and script payloads, and remove any suspicious documents
Rotate session tokens and API keys for users who previewed untrusted spreadsheet uploads while running an affected version

Patch Information

The vulnerability is fixed in Open WebUI version 0.9.3. The patch reapplies DOMPurify sanitization to the output of XLSX.utils.sheet_to_html() before it is passed to the {@html} directive. Administrators should review the official advisory and update through their standard deployment method, whether Docker, pip, or source build.

Workarounds

Disable Excel file uploads or the preview feature until the upgrade to 0.9.3 is complete
Restrict upload privileges to trusted users only by enforcing role-based access controls
Deploy a strict Content Security Policy that blocks inline script execution to reduce exploit impact

bash

# Upgrade Open WebUI via Docker
docker pull ghcr.io/open-webui/open-webui:0.9.3
docker stop open-webui
docker rm open-webui
docker run -d -p 3000:8080 \
  -v open-webui:/app/backend/data \
  --name open-webui \
  ghcr.io/open-webui/open-webui:0.9.3