GHSA-V8QJ-HXV7-MGVV
Vulnerability from github – Published: 2026-06-17 14:14 – Updated: 2026-06-17 14:14Summary
Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML.
Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working payload was validated through the Markdown preview path, resulting in JavaScript execution in the victim’s browser under the application origin.
This is a confirmed stored XSS vulnerability reachable through normal product functionality.
Affected Version
main- Reproduced on
v0.8.12
Affected Code
Mermaid is initialized in permissive mode:
https://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/utils/index.ts#L1698 The file preview path renders Mermaid output and injects the returned SVG into the DOM:
https://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/FileNav/FilePreview.svelte#L133
Impact
A successful exploit allows JavaScript execution in the victim’s browser under the Open WebUI origin when a malicious Markdown file is opened in the preview panel.
PoC
A malicious .md file containing the follwowing contents can be used to trigger the bug:
```mermaid
flowchart LR
A[click me]
click A href "javascript:alert(document.domain)" "x"
```
Steps to reproduce:
1- Create a new chat
2- Enable Code Interpreter and browse and upload the file with .md extension.
3- Clicking on the file, and clicking
click me should pop an alert
Remediation
Since mermaid has DOMPurify as a built-in, it is recommended to use the strict mode instead of loose.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.9.5"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54011"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-17T14:14:05Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nOpen WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using `innerHTML`.\n\nBecause Mermaid is configured with `securityLevel: \u0027loose\u0027`, attacker-controlled Mermaid content can be rendered unsafely in this flow. A working payload was validated through the Markdown preview path, resulting in JavaScript execution in the victim\u2019s browser under the application origin.\n\nThis is a confirmed stored XSS vulnerability reachable through normal product functionality.\n\n## Affected Version\n\n- `main`\n- Reproduced on `v0.8.12`\n\n## Affected Code\n\nMermaid is initialized in permissive mode:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/utils/index.ts#L1698\nThe file preview path renders Mermaid output and injects the returned SVG into the DOM:\n\nhttps://github.com/open-webui/open-webui/blob/9bd84258d09eefe7bf975878fb0e31a5dadfe0f8/src/lib/components/chat/FileNav/FilePreview.svelte#L133\n\n## Impact\n\nA successful exploit allows JavaScript execution in the victim\u2019s browser under the Open WebUI origin when a malicious Markdown file is opened in the preview panel.\n\n## PoC\n\nA malicious `.md` file containing the follwowing contents can be used to trigger the bug:\n````\n```mermaid\nflowchart LR\n A[click me]\n click A href \"javascript:alert(document.domain)\" \"x\"\n```\n````\nSteps to reproduce: \n1- Create a new chat \n2- Enable Code Interpreter and browse and upload the file with `.md` extension. \n\u003cimg width=\"331\" height=\"258\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bce2b754-56d1-4da1-90a9-22bcb93269f2\" /\u003e\n3- Clicking on the file, and clicking `click me` should pop an alert\n\u003cimg width=\"1103\" height=\"485\" alt=\"image\" src=\"https://github.com/user-attachments/assets/18754486-799b-434e-a2fc-dd7c09956a29\" /\u003e\n \n\n## Remediation\n\nSince `mermaid` has `DOMPurify` as a built-in, it is recommended to use the `strict` mode instead of `loose`.",
"id": "GHSA-v8qj-hxv7-mgvv",
"modified": "2026-06-17T14:14:06Z",
"published": "2026-06-17T14:14:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-v8qj-hxv7-mgvv"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Stored XSS in Mermaid Markdown Preview"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.