Cross-site scripting in Open WebUI - CVE-2026-45303
Published: May 11, 2026
Vulnerability identifier: #VU130930
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-45303
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in a victim's browser and disclose sensitive information.
The vulnerability exists due to cross-site scripting in the HTML rendering view when rendering chat content as HTML in a sandboxed iframe with script execution and same-origin access enabled. A remote user can inject a crafted script into chat content to execute arbitrary script in a victim's browser and disclose sensitive information.
User interaction is required, and exploitation against another user's context depends on vectors such as shared or imported conversations or uploaded content being rendered.
Affected software
Open WebUI
How to mitigate CVE-2026-45303
Install security update from vendor's website.
Open WebUI - update to 0.6.5