CVE-2026-4992: wandb OpenUI XSS Vulnerability

CVE-2026-4992 Overview

CVE-2026-4992 is an HTML injection vulnerability affecting wandb OpenUI versions up to 1.0. The flaw resides in the create_share and get_share functions of backend/openui/server.py within the HTMLAnnotator Component. Attackers can manipulate the ID argument to inject arbitrary HTML content into the application. The vulnerability is exploitable remotely over the network and requires user interaction. A public exploit has been released, increasing the risk of opportunistic abuse. The vendor was contacted before disclosure but did not respond, leaving affected deployments without an official remediation channel.

Critical Impact
Remote attackers can inject arbitrary HTML into shared OpenUI content, enabling phishing lures, content spoofing, and user interface manipulation against authenticated users.

Affected Products

wandb OpenUI versions up to and including 1.0
The HTMLAnnotator component within backend/openui/server.py
Deployments exposing create_share and get_share endpoints

Discovery Timeline

2026-03-27 - CVE-2026-4992 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-4992

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting / HTML Injection under [CWE-79]. It originates in the share handling logic of OpenUI, a tool for generating user interfaces with large language models. The create_share function accepts an ID parameter that is later rendered by get_share without adequate sanitization or output encoding. As a result, an attacker can craft a share resource containing malicious HTML markup, which the application returns to viewing users as part of the response body. The injected markup is interpreted by the victim's browser in the context of the OpenUI origin.

Exploitation requires the victim to load the attacker-controlled share link. Because OpenUI is intended for collaborative UI generation, share links are a common workflow element, which raises the practical likelihood of user interaction.

Root Cause

The root cause is missing or insufficient input validation and output encoding on the ID argument processed by create_share and reflected by get_share. User-supplied content is concatenated into the HTML response without neutralizing markup characters. This pattern enables HTML injection and limited script execution within the rendered share view.

Attack Vector

The attack is performed remotely over the network with no authentication required. An attacker creates a share entry that embeds malicious HTML payloads and then distributes the resulting share URL. When a victim visits the link, the application renders the attacker-controlled HTML inline. Impact is limited to integrity of the rendered page, including content spoofing, phishing overlays, and social engineering against authenticated users. A proof-of-concept has been published publicly. See the GitHub Gist PoC and the VulDB entry #353879 for technical details.

Detection Methods for CVE-2026-4992

Indicators of Compromise

Share records in OpenUI storage where the ID field contains HTML tags such as <script>, <iframe>, <img>, or inline event handlers like onerror= and onload=.
HTTP requests to create_share endpoints with payloads containing encoded angle brackets (%3C, %3E) or HTML entity-encoded sequences.
Outbound requests from user browsers to unexpected domains immediately after rendering a get_share response.

Detection Strategies

Inspect web server access logs for POST requests to create_share with anomalously long or markup-bearing ID parameters.
Deploy a web application firewall rule that flags HTML metacharacters and common XSS keywords on parameters sent to OpenUI share endpoints.
Perform content scanning on stored share records to identify entries that contain raw HTML or JavaScript payloads.

Monitoring Recommendations

Enable verbose request logging on the OpenUI backend, capturing full request bodies for create_share and get_share calls.
Forward OpenUI application logs and proxy logs to a centralized log platform for correlation against known PoC patterns.
Alert on repeated share creations from a single source IP within short time windows, which may indicate automated exploitation attempts.

How to Mitigate CVE-2026-4992

Immediate Actions Required

Restrict access to OpenUI deployments to trusted users only, placing the service behind authentication and network controls.
Disable or firewall the create_share and get_share endpoints if the sharing feature is not required.
Review existing share records for malicious HTML content and purge suspicious entries.

Patch Information

No vendor patch has been published. The maintainers did not respond to the disclosure, and no fixed release of wandb OpenUI is currently available. Organizations should track the project repository for future updates and consider applying source-level fixes that sanitize the ID parameter before storage and HTML-encode it on output.

Workarounds

Apply a reverse proxy filter that rejects requests to create_share containing HTML metacharacters in the ID parameter.
Implement a strict Content Security Policy (CSP) on the OpenUI frontend to limit the impact of injected markup and inline scripts.
Patch the application locally by adding HTML entity encoding in get_share output and input validation in create_share.
Educate users to avoid opening untrusted OpenUI share links until a sanctioned fix is available.

bash

# Example reverse proxy rule (nginx) to block markup in the ID parameter
location /create_share {
    if ($arg_id ~* "(<|>|%3C|%3E|script|onerror|onload)") {
        return 403;
    }
    proxy_pass http://openui_backend;
}