CVE-2026-54011 Overview
CVE-2026-54011 is a cross-site scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform designed to operate entirely offline. The flaw affects all versions prior to 0.9.6. Open WebUI renders Mermaid diagram blocks from Markdown files in the file preview panel and inserts the resulting Scalable Vector Graphics (SVG) into the Document Object Model (DOM) using innerHTML. Mermaid is configured with securityLevel: 'loose', which permits attacker-controlled diagram content to execute as JavaScript. The issue is tracked as [CWE-79] and was fixed in version 0.9.6.
Critical Impact
An authenticated attacker can deliver a crafted Markdown file containing a malicious Mermaid block to execute JavaScript in the victim's browser under the application origin.
Affected Products
- Open WebUI versions prior to 0.9.6
- openwebui:open_webui package (all releases before the fix)
- Self-hosted Open WebUI deployments rendering user-supplied Markdown
Discovery Timeline
- 2026-06-23 - CVE-2026-54011 published to the National Vulnerability Database
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-54011
Vulnerability Analysis
The vulnerability resides in the Markdown preview rendering path of Open WebUI. The application accepts Markdown files and renders embedded Mermaid diagrams in the file preview panel. The rendered SVG output is then injected into the page DOM using innerHTML, which evaluates any HTML or script content contained in the string.
Mermaid is initialized with the option securityLevel: 'loose'. This configuration disables Mermaid's built-in HTML sanitization, allowing arbitrary HTML and event handlers to pass through diagram definitions into the rendered SVG. Combined with innerHTML insertion, attacker-controlled diagram content reaches the browser as executable markup.
The advisory confirms a working payload through the Markdown preview path resulted in JavaScript execution in the victim's browser under the application origin. Successful execution grants the attacker access to the victim's session context, including any authenticated API tokens, conversation history, and uploaded files.
Root Cause
The root cause is unsafe DOM injection combined with a permissive Mermaid configuration. Setting securityLevel: 'loose' removes Mermaid's HTML sanitization step. Using innerHTML rather than safer alternatives such as textContent or trusted-types-aware insertion means that any HTML elements or inline event handlers embedded in the diagram output execute in the application origin.
Attack Vector
An attacker with low privileges uploads or shares a Markdown file containing a malicious Mermaid block. The attack requires user interaction: the victim must open the file in the preview panel. When Mermaid processes the diagram, the resulting SVG carries attacker-controlled HTML or event handler attributes. The browser executes the embedded JavaScript when the SVG is inserted into the DOM, scoped to the Open WebUI origin.
Technical details of the validated payload are available in the GitHub Security Advisory GHSA-v8qj-hxv7-mgvv. No public proof-of-concept exploit is currently listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-54011
Indicators of Compromise
- Markdown files containing Mermaid code fences with embedded <script> tags, onerror, onload, or other inline event handler attributes.
- Outbound HTTP requests from user browsers to unexpected domains immediately after Markdown previews are opened.
- Unexpected API calls to Open WebUI endpoints originating from authenticated sessions without corresponding user actions.
- Newly created chat sessions, API keys, or configuration changes that do not map to legitimate user activity.
Detection Strategies
- Inspect uploaded Markdown files for Mermaid fenced blocks containing HTML tags, JavaScript URI schemes, or event handler attributes.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution attempts in the Open WebUI origin.
- Review web server and reverse proxy logs for Markdown uploads followed by preview requests from a different user session.
Monitoring Recommendations
- Monitor Open WebUI audit logs for file upload, share, and preview events correlated by user and timestamp.
- Alert on browser console errors or CSP violation reports referencing Mermaid-rendered SVG content.
- Track the deployed Open WebUI version across hosts and flag any instance running a release earlier than 0.9.6.
How to Mitigate CVE-2026-54011
Immediate Actions Required
- Upgrade Open WebUI to version 0.9.6 or later on all self-hosted instances.
- Restrict Markdown file upload and sharing permissions to trusted users until the patch is applied.
- Invalidate active sessions and rotate any API keys that may have been exposed through preview pages.
- Enable a strict Content Security Policy that blocks inline script execution within the Open WebUI origin.
Patch Information
The vulnerability is fixed in Open WebUI 0.9.6. The maintainers published GHSA-v8qj-hxv7-mgvv describing the fix. Administrators should pull the updated container image or upgrade the Python package and restart the service to apply the patch.
Workarounds
- Disable Markdown preview rendering for untrusted uploads until the upgrade is complete.
- Block Mermaid fenced code blocks at an ingress proxy or pre-processing step before content reaches the renderer.
- Apply a CSP with script-src 'self' and disallow inline event handlers to limit the impact of injection.
# Upgrade Open WebUI to the patched release
pip install --upgrade open-webui==0.9.6
# Or update the official container image
docker pull ghcr.io/open-webui/open-webui:0.9.6
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 ghcr.io/open-webui/open-webui:0.9.6
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
