CVE-2026-26192: Open webui Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xc8p-9rr6-97r2",
  "modified" : "2026-07-07T16:51:13Z",
  "published" : "2026-07-07T16:51:13Z",
  "aliases" : [ "CVE-2026-26192" ],
  "summary" : "Open WebUI vulnerable to Stored XSS via iFrame in citations model",
  "details" : "### Summary\nManually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document payload in a chat. The payload also executes when the citation is viewed on a shared chat.\n\n### Details\nThe vulnerability stems from how iFrame are implemented here:\nhttps://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/Citations/CitationModal.svelte#L163-L170\nThe `html` attribute can be controlled by a user who manually edits the chat history. Since `allow-scripts` and `allow-same-origin` are harcoded here the sandboxing offers essentially no protection.\n\n### PoC\nCreate an arbitrary chat with a file upload attached:\n<img width=\"2462\" height=\"1148\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fad83c74-036d-41b8-bc44-87bf2a538b21\" />\nEdit the response\n<img width=\"768\" height=\"206\" alt=\"image\" src=\"https://github.com/user-attachments/assets/41a7342a-cc41-433e-8820-0bc6ed08ddd7\" />\n<img width=\"2142\" height=\"796\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fb731111-e082-4172-80d1-34cff6b2a511\" />\nBefore saving, configure the browser to use an HTTP proxy tool (Burp/Caido/ZAP) and intercept the save request. Find the object within the `history` and then `messages` objects (not the `messages` array) that contains the document source.\n<img width=\"2122\" height=\"1388\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1b4fbced-a6de-414d-b063-9cae44e3f449\" />\nAdd `html: true` to metadata, update the document to an XSS payload, and forward the request.\n<img width=\"2240\" height=\"1358\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fd27971b-f707-458f-a14d-254f9f3ad1fa\" />\nObserve the payload is rendered in the iFrame and the javascript executes.\n<img width=\"2698\" height=\"1696\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b4e31cb4-d4cc-41a9-be42-802e9b1a798d\" />\nThe payload also executes when viewed from a shared version of the chat.\n<img width=\"2742\" height=\"1258\" alt=\"image\" src=\"https://github.com/user-attachments/assets/92ee501d-8f14-4c32-8f3c-f4d3ca304ee5\" />\n\n\n### Impact\nAny user can create a weaponised chat that can be shared and subsequently used to target other users.\n\nLow privilege users are at risk of having their session taken over by a payload that reads their token from local storage and exfiltrates it to an attacker controlled server.\n\nAdmins are at risk of exposing the server to RCE via same chain described in https://github.com/advisories/GHSA-w7xj-8fx7-wfch.\n\n### Caveats\nThe victim must expand the sources and click the document containing the payload to trigger this issue.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "open-webui"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.7.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/security/advisories/GHSA-xc8p-9rr6-97r2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26192"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/open-webui/open-webui"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/Citations/CitationModal.svelte#L163-L170"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-07T16:51:13Z",
    "nvd_published_at" : "2026-02-19T20:25:42Z"
  }
}