CVE-2026-44568 (GCVE-0-2026-44568)
Vulnerability from cvelistv5 – Published: 2026-05-15 19:24 – Updated: 2026-05-15 20:19
VLAI
EPSS
VEX
Title
Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
Summary
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse() inside {@html} with an incorrect DOMPurify application order. An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This vulnerability is fixed in 0.9.0.
Severity
4.8 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 20:18 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/open-webui/open-webui/security… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| open-webui | open-webui |
Affected:
< 0.9.0
|
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44568",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T20:18:40.585756Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T20:19:00.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"status": "affected",
"version": "\u003c 0.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured \"Pending User Overlay Content\" using marked.parse() inside {@html} with an incorrect DOMPurify application order. An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This vulnerability is fixed in 0.9.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T19:24:46.490Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc"
}
],
"source": {
"advisory": "GHSA-fq3v-xjjx-95rc",
"discovery": "UNKNOWN"
},
"title": "Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44568",
"datePublished": "2026-05-15T19:24:46.490Z",
"dateReserved": "2026-05-06T20:59:00.595Z",
"dateUpdated": "2026-05-15T20:19:00.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-44568",
"date": "2026-08-23",
"epss": "0.0017",
"percentile": "0.06677"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-44568\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-15T20:16:48.263\",\"lastModified\":\"2026-06-17T10:50:48.483\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured \\\"Pending User Overlay Content\\\" using marked.parse() inside {@html} with an incorrect DOMPurify application order. An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This vulnerability is fixed in 0.9.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"open-webui\",\"product\":\"open-webui\",\"versions\":[{\"version\":\"\u003c 0.9.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-15T20:18:40.585756Z\",\"id\":\"CVE-2026-44568\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.9.0\",\"matchCriteriaId\":\"0FB90EC3-1665-446E-AA35-4AEC207A2F3B\"}]}]}],\"references\":[{\"url\":\"https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"current_release_date": "2026-06-05T19:25:16+00:00",
"cve": "CVE-2026-44568",
"id": "CVE-2026-44568",
"initial_release_date": "2026-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44568.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44568\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-15T20:18:40.585756Z\"}}}], \"references\": [{\"url\": \"https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-15T20:18:55.588Z\"}}], \"cna\": {\"title\": \"Open WebUI: Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order\", \"source\": {\"advisory\": \"GHSA-fq3v-xjjx-95rc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"open-webui\", \"product\": \"open-webui\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.9.0\"}]}], \"references\": [{\"url\": \"https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc\", \"name\": \"https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured \\\"Pending User Overlay Content\\\" using marked.parse() inside {@html} with an incorrect DOMPurify application order. An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This vulnerability is fixed in 0.9.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-15T19:24:46.490Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-44568\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-15T20:19:00.400Z\", \"dateReserved\": \"2026-05-06T20:59:00.595Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-15T19:24:46.490Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-44568
Vulnerability from fkie_nvd - Published: 2026-05-15 20:16 - Updated: 2026-06-17 10:50
Severity
Summary
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse() inside {@html} with an incorrect DOMPurify application order. An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This vulnerability is fixed in 0.9.0.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc | Exploit, Mitigation, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc | Exploit, Mitigation, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openwebui | open_webui | * |
{
"affected": [
{
"affectedData": [
{
"product": "open-webui",
"vendor": "open-webui",
"versions": [
{
"status": "affected",
"version": "\u003c 0.9.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FB90EC3-1665-446E-AA35-4AEC207A2F3B",
"versionEndExcluding": "0.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the AccountPending.svelte component renders the admin-configured \"Pending User Overlay Content\" using marked.parse() inside {@html} with an incorrect DOMPurify application order. An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This vulnerability is fixed in 0.9.0."
}
],
"id": "CVE-2026-44568",
"lastModified": "2026-06-17T10:50:48.483",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-44568",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T20:18:40.585756Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-15T20:16:48.263",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-FQ3V-XJJX-95RC
Vulnerability from github – Published: 2026-05-08 22:21 – Updated: 2026-05-15 23:53
VLAI
Summary
Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
Details
Vulnerability Details
CWE-79: Cross-site Scripting (XSS)
The AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse() inside {@html} with an incorrect DOMPurify application order:
Vulnerable Code
src/lib/components/layout/Overlay/AccountPending.svelte (lines 43-48):
{@html marked.parse(
DOMPurify.sanitize(
($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>')
)
)}
DOMPurify is applied to the raw Markdown input before marked.parse() processes it. This is the wrong order. DOMPurify sanitizes the Markdown text (which contains no HTML tags), then marked.parse() converts Markdown link syntax into HTML <a> tags with javascript: href, and the result is rendered with {@html} unsanitized.
The correct pattern (used elsewhere in the codebase, e.g., NotebookView.svelte:77) is:
DOMPurify.sanitize(marked.parse(src)) // sanitize AFTER markdown parsing
Steps to Reproduce
Prerequisites
- Open WebUI v0.8.10
- Admin account
- A second user account with "pending" role
Steps
-
Log in as admin and navigate to Admin Settings → Settings → General.
-
Set Default User Role to
pending. -
In the Pending User Overlay Content field, enter:
# Account Pending
Your account is under review.
[Contact Support](javascript:alert(document.domain))
-
Save the settings.
-
In a separate browser (or incognito window), create a new account or log in as a pending user.
-
The pending overlay is displayed. Click the "Contact Support" link.
-
A JavaScript alert dialog appears showing
localhost(the document domain), confirming XSS execution.
Verified Output
The alert(document.domain) executes successfully, displaying "localhost" in a JavaScript dialog box.
Impact
An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This could be used to:
- Session hijacking: Steal pending users' JWT tokens from cookies/localStorage
- Credential theft: Replace the pending overlay with a fake login form
- Phishing: Redirect pending users to malicious sites
While this requires admin privileges to set the overlay content, it enables an admin to attack pending users (who have not yet been granted full access). In multi-admin deployments, a compromised admin account could use this to escalate attacks.
Proposed Fix
Apply DOMPurify after marked.parse(), not before:
<!-- Before (vulnerable): -->
{@html marked.parse(
DOMPurify.sanitize(
($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>')
)
)}
<!-- After (fixed): -->
{@html DOMPurify.sanitize(
marked.parse(
($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>'),
{ async: false }
)
)}
Severity
4.8 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.12"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44568"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T22:21:33Z",
"nvd_published_at": "2026-05-15T20:16:48Z",
"severity": "MODERATE"
},
"details": "## Vulnerability Details\n\n**CWE-79**: Cross-site Scripting (XSS)\n\nThe `AccountPending.svelte` component renders the admin-configured \"Pending User Overlay Content\" using `marked.parse()` inside `{@html}` with an incorrect DOMPurify application order:\n\n### Vulnerable Code\n\n**`src/lib/components/layout/Overlay/AccountPending.svelte` (lines 43-48)**:\n\n```svelte\n{@html marked.parse(\n DOMPurify.sanitize(\n ($config?.ui?.pending_user_overlay_content ?? \u0027\u0027).replace(/\\n/g, \u0027\u003cbr\u003e\u0027)\n )\n)}\n```\n\nDOMPurify is applied to the raw Markdown input **before** `marked.parse()` processes it. This is the wrong order. DOMPurify sanitizes the Markdown text (which contains no HTML tags), then `marked.parse()` converts Markdown link syntax into HTML `\u003ca\u003e` tags with `javascript:` href, and the result is rendered with `{@html}` unsanitized.\n\nThe correct pattern (used elsewhere in the codebase, e.g., `NotebookView.svelte:77`) is:\n```javascript\nDOMPurify.sanitize(marked.parse(src)) // sanitize AFTER markdown parsing\n```\n\n## Steps to Reproduce\n\n### Prerequisites\n- Open WebUI v0.8.10\n- Admin account\n- A second user account with \"pending\" role\n\n### Steps\n\n1. Log in as admin and navigate to **Admin Settings** \u2192 **Settings** \u2192 **General**.\n\n2. Set **Default User Role** to `pending`.\n\n3. In the **Pending User Overlay Content** field, enter:\n```\n# Account Pending\n\nYour account is under review.\n\n[Contact Support](javascript:alert(document.domain))\n```\n\n4. Save the settings.\n\n5. In a separate browser (or incognito window), create a new account or log in as a pending user.\n\n6. The pending overlay is displayed. Click the \"Contact Support\" link.\n\n7. A JavaScript alert dialog appears showing `localhost` (the document domain), confirming XSS execution.\n\n### Verified Output\n\nThe `alert(document.domain)` executes successfully, displaying \"localhost\" in a JavaScript dialog box.\n\n## Impact\n\nAn admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This could be used to:\n\n- **Session hijacking**: Steal pending users\u0027 JWT tokens from cookies/localStorage\n- **Credential theft**: Replace the pending overlay with a fake login form\n- **Phishing**: Redirect pending users to malicious sites\n\nWhile this requires admin privileges to set the overlay content, it enables an admin to attack pending users (who have not yet been granted full access). In multi-admin deployments, a compromised admin account could use this to escalate attacks.\n\n## Proposed Fix\n\nApply DOMPurify **after** `marked.parse()`, not before:\n\n```svelte\n\u003c!-- Before (vulnerable): --\u003e\n{@html marked.parse(\n DOMPurify.sanitize(\n ($config?.ui?.pending_user_overlay_content ?? \u0027\u0027).replace(/\\n/g, \u0027\u003cbr\u003e\u0027)\n )\n)}\n\n\u003c!-- After (fixed): --\u003e\n{@html DOMPurify.sanitize(\n marked.parse(\n ($config?.ui?.pending_user_overlay_content ?? \u0027\u0027).replace(/\\n/g, \u0027\u003cbr\u003e\u0027),\n { async: false }\n )\n)}\n```\n\u003cimg width=\"1510\" height=\"1093\" alt=\"2026-03-23_03-07\" src=\"https://github.com/user-attachments/assets/bcc94dd6-4f06-472b-9979-9759458c76b3\" /\u003e",
"id": "GHSA-fq3v-xjjx-95rc",
"modified": "2026-05-15T23:53:43Z",
"published": "2026-05-08T22:21:33Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44568"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order"
}
PYSEC-2026-2724
Vulnerability from pysec - Published: 2026-07-13 15:15 - Updated: 2026-07-13 16:05
VLAI
Details
Vulnerability Details
CWE-79: Cross-site Scripting (XSS)
The AccountPending.svelte component renders the admin-configured "Pending User Overlay Content" using marked.parse() inside {@html} with an incorrect DOMPurify application order:
Vulnerable Code
src/lib/components/layout/Overlay/AccountPending.svelte (lines 43-48):
{@html marked.parse(
DOMPurify.sanitize(
($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>')
)
)}
DOMPurify is applied to the raw Markdown input before marked.parse() processes it. This is the wrong order. DOMPurify sanitizes the Markdown text (which contains no HTML tags), then marked.parse() converts Markdown link syntax into HTML <a> tags with javascript: href, and the result is rendered with {@html} unsanitized.
The correct pattern (used elsewhere in the codebase, e.g., NotebookView.svelte:77) is:
DOMPurify.sanitize(marked.parse(src)) // sanitize AFTER markdown parsing
Steps to Reproduce
Prerequisites
- Open WebUI v0.8.10
- Admin account
- A second user account with "pending" role
Steps
-
Log in as admin and navigate to Admin Settings → Settings → General.
-
Set Default User Role to
pending. -
In the Pending User Overlay Content field, enter:
# Account Pending
Your account is under review.
[Contact Support](javascript:alert(document.domain))
-
Save the settings.
-
In a separate browser (or incognito window), create a new account or log in as a pending user.
-
The pending overlay is displayed. Click the "Contact Support" link.
-
A JavaScript alert dialog appears showing
localhost(the document domain), confirming XSS execution.
Verified Output
The alert(document.domain) executes successfully, displaying "localhost" in a JavaScript dialog box.
Impact
An admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This could be used to:
- Session hijacking: Steal pending users' JWT tokens from cookies/localStorage
- Credential theft: Replace the pending overlay with a fake login form
- Phishing: Redirect pending users to malicious sites
While this requires admin privileges to set the overlay content, it enables an admin to attack pending users (who have not yet been granted full access). In multi-admin deployments, a compromised admin account could use this to escalate attacks.
Proposed Fix
Apply DOMPurify after marked.parse(), not before:
<!-- Before (vulnerable): -->
{@html marked.parse(
DOMPurify.sanitize(
($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>')
)
)}
<!-- After (fixed): -->
{@html DOMPurify.sanitize(
marked.parse(
($config?.ui?.pending_user_overlay_content ?? '').replace(/\n/g, '<br>'),
{ async: false }
)
)}
Severity
4.8 (Medium)
Impacted products
| Name | purl | open-webui | pkg:pypi/open-webui |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui",
"purl": "pkg:pypi/open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.1.124",
"0.1.125",
"0.2.0",
"0.2.1",
"0.2.2",
"0.2.3",
"0.2.4",
"0.2.5",
"0.3.0",
"0.3.1",
"0.3.10",
"0.3.12",
"0.3.13",
"0.3.14",
"0.3.15",
"0.3.16",
"0.3.17",
"0.3.17.dev2",
"0.3.17.dev3",
"0.3.17.dev4",
"0.3.17.dev5",
"0.3.18",
"0.3.19",
"0.3.2",
"0.3.20",
"0.3.21",
"0.3.22",
"0.3.23",
"0.3.24",
"0.3.25",
"0.3.26",
"0.3.27",
"0.3.27.dev1",
"0.3.27.dev2",
"0.3.27.dev3",
"0.3.28",
"0.3.29",
"0.3.3",
"0.3.30",
"0.3.30.dev1",
"0.3.30.dev2",
"0.3.31",
"0.3.31.dev1",
"0.3.32",
"0.3.33",
"0.3.33.dev1",
"0.3.34",
"0.3.35",
"0.3.4",
"0.3.5",
"0.3.6",
"0.3.7",
"0.3.8",
"0.3.9",
"0.4.0",
"0.4.0.dev1",
"0.4.0.dev2",
"0.4.1",
"0.4.2",
"0.4.3",
"0.4.4",
"0.4.5",
"0.4.6",
"0.4.6.dev1",
"0.4.7",
"0.4.8",
"0.5.0",
"0.5.0.dev1",
"0.5.0.dev2",
"0.5.1",
"0.5.10",
"0.5.11",
"0.5.12",
"0.5.13",
"0.5.14",
"0.5.15",
"0.5.16",
"0.5.17",
"0.5.18",
"0.5.19",
"0.5.2",
"0.5.20",
"0.5.3",
"0.5.3.dev1",
"0.5.4",
"0.5.5",
"0.5.6",
"0.5.7",
"0.5.8",
"0.5.9",
"0.6.0",
"0.6.1",
"0.6.10",
"0.6.11",
"0.6.12",
"0.6.13",
"0.6.14",
"0.6.15",
"0.6.16",
"0.6.18",
"0.6.19",
"0.6.2",
"0.6.20",
"0.6.21",
"0.6.22",
"0.6.23",
"0.6.24",
"0.6.25",
"0.6.26",
"0.6.26.dev1",
"0.6.27",
"0.6.28",
"0.6.29",
"0.6.3",
"0.6.30",
"0.6.31",
"0.6.32",
"0.6.33",
"0.6.34",
"0.6.35",
"0.6.36",
"0.6.37",
"0.6.38",
"0.6.39",
"0.6.4",
"0.6.40",
"0.6.41",
"0.6.42",
"0.6.43",
"0.6.5",
"0.6.6",
"0.6.6.dev1",
"0.6.7",
"0.6.8",
"0.6.9",
"0.7.0",
"0.7.1",
"0.7.2",
"0.8.0",
"0.8.1",
"0.8.10",
"0.8.11",
"0.8.12",
"0.8.2",
"0.8.3",
"0.8.4",
"0.8.5",
"0.8.6",
"0.8.7",
"0.8.8",
"0.8.9"
]
}
],
"aliases": [
"CVE-2026-44568",
"GHSA-fq3v-xjjx-95rc"
],
"details": "## Vulnerability Details\n\n**CWE-79**: Cross-site Scripting (XSS)\n\nThe `AccountPending.svelte` component renders the admin-configured \"Pending User Overlay Content\" using `marked.parse()` inside `{@html}` with an incorrect DOMPurify application order:\n\n### Vulnerable Code\n\n**`src/lib/components/layout/Overlay/AccountPending.svelte` (lines 43-48)**:\n\n```svelte\n{@html marked.parse(\n DOMPurify.sanitize(\n ($config?.ui?.pending_user_overlay_content ?? \u0027\u0027).replace(/\\n/g, \u0027\u003cbr\u003e\u0027)\n )\n)}\n```\n\nDOMPurify is applied to the raw Markdown input **before** `marked.parse()` processes it. This is the wrong order. DOMPurify sanitizes the Markdown text (which contains no HTML tags), then `marked.parse()` converts Markdown link syntax into HTML `\u003ca\u003e` tags with `javascript:` href, and the result is rendered with `{@html}` unsanitized.\n\nThe correct pattern (used elsewhere in the codebase, e.g., `NotebookView.svelte:77`) is:\n```javascript\nDOMPurify.sanitize(marked.parse(src)) // sanitize AFTER markdown parsing\n```\n\n## Steps to Reproduce\n\n### Prerequisites\n- Open WebUI v0.8.10\n- Admin account\n- A second user account with \"pending\" role\n\n### Steps\n\n1. Log in as admin and navigate to **Admin Settings** \u2192 **Settings** \u2192 **General**.\n\n2. Set **Default User Role** to `pending`.\n\n3. In the **Pending User Overlay Content** field, enter:\n```\n# Account Pending\n\nYour account is under review.\n\n[Contact Support](javascript:alert(document.domain))\n```\n\n4. Save the settings.\n\n5. In a separate browser (or incognito window), create a new account or log in as a pending user.\n\n6. The pending overlay is displayed. Click the \"Contact Support\" link.\n\n7. A JavaScript alert dialog appears showing `localhost` (the document domain), confirming XSS execution.\n\n### Verified Output\n\nThe `alert(document.domain)` executes successfully, displaying \"localhost\" in a JavaScript dialog box.\n\n## Impact\n\nAn admin can inject arbitrary JavaScript into the Pending User Overlay Content that executes in the browser context of any pending user who views the overlay page. This could be used to:\n\n- **Session hijacking**: Steal pending users\u0027 JWT tokens from cookies/localStorage\n- **Credential theft**: Replace the pending overlay with a fake login form\n- **Phishing**: Redirect pending users to malicious sites\n\nWhile this requires admin privileges to set the overlay content, it enables an admin to attack pending users (who have not yet been granted full access). In multi-admin deployments, a compromised admin account could use this to escalate attacks.\n\n## Proposed Fix\n\nApply DOMPurify **after** `marked.parse()`, not before:\n\n```svelte\n\u003c!-- Before (vulnerable): --\u003e\n{@html marked.parse(\n DOMPurify.sanitize(\n ($config?.ui?.pending_user_overlay_content ?? \u0027\u0027).replace(/\\n/g, \u0027\u003cbr\u003e\u0027)\n )\n)}\n\n\u003c!-- After (fixed): --\u003e\n{@html DOMPurify.sanitize(\n marked.parse(\n ($config?.ui?.pending_user_overlay_content ?? \u0027\u0027).replace(/\\n/g, \u0027\u003cbr\u003e\u0027),\n { async: false }\n )\n)}\n```\n\u003cimg width=\"1510\" height=\"1093\" alt=\"2026-03-23_03-07\" src=\"https://github.com/user-attachments/assets/bcc94dd6-4f06-472b-9979-9759458c76b3\" /\u003e",
"id": "PYSEC-2026-2724",
"modified": "2026-07-13T16:05:12.459747Z",
"published": "2026-07-13T15:15:42.754381Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-fq3v-xjjx-95rc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44568"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/open-webui"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-fq3v-xjjx-95rc"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…