CVE-2026-26193: Open webui Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vjm7-m4xh-7wrc",
  "modified" : "2026-07-07T16:51:22Z",
  "published" : "2026-07-07T16:51:22Z",
  "aliases" : [ "CVE-2026-26193" ],
  "summary" : "Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages",
  "details" : "### Summary\nManually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the \"iframe Sandbox Allow Same Origin\" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance.\n\n### Details\nThe flaw stems from how iFrames are constructed here:\nhttps://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/ResponseMessage.svelte#L689-L703\n\n`messages.embeds` is a user controlled property and so can be arbitrarily set by the user to a payload of their choosing. Since `allowScripts` and `allowSameOrigin` are harcoded as true here the sandboxing offers essentially no protection.\n\n### PoC\nCreate an arbitrary chat:\n<img width=\"2468\" height=\"1426\" alt=\"image\" src=\"https://github.com/user-attachments/assets/41e32f5c-3fa7-4208-a71f-85556eec6309\" />\nEdit the model response:\n<img width=\"632\" height=\"192\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b1e79303-360f-46e3-8d6d-3309c3ec30af\" />\n<img width=\"2150\" height=\"434\" alt=\"image\" src=\"https://github.com/user-attachments/assets/78f19d7f-10dc-4e91-83cc-2d4811e58496\" />\nBefore saving, configure the browser to use an HTTP proxy tool (Burp/Caido/ZAP) and intercept the save request. Find the object within the `history` and then `messages` objects (not the `messages` array) that corresponds to the edited text.\n<img width=\"2024\" height=\"1528\" alt=\"image\" src=\"https://github.com/user-attachments/assets/953e5368-8e93-428b-b223-c695eacfe7b9\" />\nOn this object, add an `embeds` key and list value as shown below, forward the request and refresh the page.\n<img width=\"1904\" height=\"1530\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0e56be6f-5513-490e-9961-972bdfbd5d8b\" />\nThis results in XSS via the controlled content getting rendered in the iFrame. Note the bold text is just to aid demonstration. `console.log` is used to prove JS execution because the lack of `allow-modals` on the iFrame sandbox prevents alerts. \n<img width=\"2752\" height=\"1686\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4858f7b3-4e2f-4fab-a5a5-196df26bcdce\" />\nThe same payload triggers when the chat is shared.\n<img width=\"2730\" height=\"1426\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ee88b538-9781-4276-b681-9953974b826d\" />\n\n### Impact\nAny user can create a weaponised chat that can be shared and subsequently used to target other users.\n\nLow privilege users are at risk of having their session taken over by a payload that reads their token from local storage and exfiltrates it to an attacker controlled server.\n\nAdmins are at risk of exposing the server to RCE via same chain described in GHSA-w7xj-8fx7-wfch.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.6.44"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.6.43"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-vjm7-m4xh-7wrc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26193"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/ResponseMessage.svelte#L689-L703"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-07T16:51:22Z",
    "nvd_published_at" : "2026-02-19T20:25:42Z"
  }
}