AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Open WebUIGHSA-5jp3-wp5v-5363

Open WebUI Stored Cross-Site Scripting Vulnerability

Open WebUI

CVE-2024-6706 · Published Aug 8, 2024 · updated Oct 26, 2026

Medium6.1
Fix: upgrade to 0.3.14 or later
GitHub advisory

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

Affected versions

PackageAffectedFixed in
open-webui
PyPI
< 0.3.140.3.14

Changes since it was listed

Fixed inOct 27Fixed in: none to 0.3.14
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
CVE-2024-6706, PYSEC-2026-1722

More Open WebUI advisories

All Open WebUI
High 7.5Mar 20, 2025Open WebUI Uncontrolled Resource Consumption vulnerabilityCVE-2024-7036no fix yetHigh 7.5Mar 20, 2025Open WebUI has vulnerable dependency on starlette via fastapiGHSA-w466-2wfc-8g58fixed in 0.5.8High 7.5Mar 20, 2025Open WebUI Uncontrolled Resource Consumption vulnerabilityCVE-2024-12534no fix yetHigh 7.5Mar 20, 2025Open WebUI Uncontrolled Resource Consumption vulnerabilityCVE-2024-12537no fix yetMedium 6.5Oct 9, 2024open-webui Insecure Direct Object Reference (IDOR) vulnerabilityCVE-2024-7041fixed in 0.6.3Medium 6.5Oct 9, 2024open-webui allows writing and deleting arbitrary filesCVE-2024-7037no fix yet