PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45303 open-webui CVE debrief

Open WebUI versions prior to 0.6.5 contain a stored cross-site scripting (XSS) vulnerability in the HTML rendering view. The application's chat visualization feature embeds HTML content within an iFrame using the sandbox directive `allow-scripts allow-forms allow-same-origin`. This configuration permits embedded scripts to execute and access parent-origin data including local storage, effectively nullifying the sandbox's security boundaries. An attacker with the ability to inject malicious HTML content into a chat could leverage this to access sensitive data or perform actions in the context of the victim's session. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects network attack vector, high attack complexity, low privileges required, user interaction required, changed scope, and high impacts to confidentiality and integrity. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vendor
open-webui
Product
Unknown
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations operating self-hosted Open WebUI instances for offline AI workloads, particularly those processing untrusted or multi-tenant chat content. Security teams responsible for AI platform hardening and developers implementing sandboxed content rendering in web applications.

Technical summary

The vulnerability exists in Open WebUI's HTML visualization feature, which renders chat content in a sandboxed iFrame. The sandbox attribute includes `allow-scripts`, `allow-forms`, and `allow-same-origin` permissions. The `allow-same-origin` directive combined with `allow-scripts` permits the embedded content to access the parent document's origin, including local storage and cookies. This configuration defeats the primary security purpose of the sandbox, allowing injected scripts to bypass isolation boundaries. The attack requires user interaction to view malicious content and low privileges to inject HTML, with high attack complexity due to the need to craft effective payloads within the sandbox constraints. The vulnerability does not affect availability per the CVSS vector.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Open WebUI to version 0.6.5 or later to remediate the sandbox escape vulnerability
  • Review chat content sanitization controls to prevent injection of malicious HTML
  • Audit local storage and session data accessible to the application for sensitive information
  • Consider implementing Content Security Policy (CSP) headers as defense-in-depth for iFrame content
  • Monitor for anomalous script execution patterns in browser-based AI platform deployments

Evidence notes

Vulnerability confirmed through vendor security advisory GHSA-4vrc-m9ch-6m3r. Affected versions identified via CPE criteria as all versions prior to 0.6.5. CVSS score and vector sourced from NVD record. CWE-79 classification provided by GitHub Security Advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45303 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45303

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45303 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45303

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.