CVE-2026-109291 open-webui CVE debrief

Who should care

Defenders responsible for Open WebUI deployments should assess exposure and prioritize verification and updates. Users who have accessed potentially crafted chats may also be affected.

Why it matters

CVE-2026-109291 is a stored XSS vulnerability in Open WebUI that allows authenticated users to execute script in victims' sessions. Defenders should prioritize verification and updates, and assess exposure for users who have accessed potentially crafted chats.

• Stealing of localStorage.token
• Potential for attackers to act as victims
• Verification of Open WebUI version and exposure
• Monitoring for suspicious activity

Technical summary

The vulnerability allows authenticated users to store javascript: URLs in citation embed_url fields, which can be executed in victims' sessions when clicked. Attackers can share crafted chats with citations that, when clicked, pass the URL to window.open, potentially allowing them to steal localStorage.token and act as the victim. Open WebUI versions 0.6.33 before 0.11.4 contain a stored cross-site scripting (XSS) vulnerability via the citation embed_url field. Defenders should prioritize verifying and updating Open WebUI to version 0.11.4 or later, and assess exposure for users who have accessed potentially crafted chats.

Defensive priority

Defenders should prioritize verifying and updating Open WebUI to version 0.11.4 or later, and assess exposure for users who have accessed potentially crafted chats.

Recommended defensive actions

• Verify and update Open WebUI to version 0.11.4 or later
• Assess exposure for users who have accessed potentially crafted chats
• Monitor for suspicious activity related to Open WebUI
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information on the vulnerability. Supplemental sources include a GitHub Security Advisory and a VulnCheck Advisory. Open WebUI versions 0.6.33 before 0.11.4 contain a stored cross-site scripting (XSS) vulnerability via the citation embed_url field. Authenticated users can store javascript: URLs, which can be executed in victims' sessions when clicked. Attackers can share crafted chats with citations that, when clicked, pass the URL to window.open, potentially allow

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.