SB2026051159 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Open WebUI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026051159

SB2026051159 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Open WebUI

Published: May 11, 2026

Security Bulletin ID SB2026051159
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CVE-ID: N/A)

CWE-ID: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in the victim's browser.

The vulnerability exists due to improper neutralization of script-related html tags in the SVG renderer when rendering edited SVG content. A remote user can save crafted HTML or JavaScript in a thread and share it with another user to execute arbitrary script in the victim's browser.

User interaction is required when another user opens the shared thread containing the rendered SVG.


Remediation

Install update from vendor's website.

References