PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45303 open-webui CVE debrief

Open WebUI versions prior to 0.6.5 contain a stored cross-site scripting (XSS) vulnerability in the HTML rendering view. The application's chat visualization feature embeds HTML content within an iFrame using the sandbox directive `allow-scripts allow-forms allow-same-origin`. This configuration permits embedded scripts to execute and access parent-origin data including local storage, effectively nullifying the sandbox's security boundaries. An attacker with the ability to inject malicious HTML content into a chat could leverage this to access sensitive data or perform actions in the context of the victim's session. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects network attack vector, high attack complexity, low privileges required, user interaction required, changed scope, and high impacts to confidentiality and integrity. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vendor
open-webui
Product
Unknown
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-19
Advisory published
2026-05-15
Advisory updated
2026-05-19

Who should care

Organizations operating self-hosted Open WebUI instances for offline AI workloads, particularly those processing untrusted or multi-tenant chat content. Security teams responsible for AI platform hardening and developers implementing sandboxed content rendering in web applications.

Technical summary

The vulnerability exists in Open WebUI's HTML visualization feature, which renders chat content in a sandboxed iFrame. The sandbox attribute includes `allow-scripts`, `allow-forms`, and `allow-same-origin` permissions. The `allow-same-origin` directive combined with `allow-scripts` permits the embedded content to access the parent document's origin, including local storage and cookies. This configuration defeats the primary security purpose of the sandbox, allowing injected scripts to bypass isolation boundaries. The attack requires user interaction to view malicious content and low privileges to inject HTML, with high attack complexity due to the need to craft effective payloads within the sandbox constraints. The vulnerability does not affect availability per the CVSS vector.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Open WebUI to version 0.6.5 or later to remediate the sandbox escape vulnerability
  • Review chat content sanitization controls to prevent injection of malicious HTML
  • Audit local storage and session data accessible to the application for sensitive information
  • Consider implementing Content Security Policy (CSP) headers as defense-in-depth for iFrame content
  • Monitor for anomalous script execution patterns in browser-based AI platform deployments

Evidence notes

Vulnerability confirmed through vendor security advisory GHSA-4vrc-m9ch-6m3r. Affected versions identified via CPE criteria as all versions prior to 0.6.5. CVSS score and vector sourced from NVD record. CWE-79 classification provided by GitHub Security Advisories.

Official resources

2026-05-15