Open WebUIGHSA-5jp3-wp5v-5363
Open WebUI Stored Cross-Site Scripting Vulnerability
Medium6.1CVE-2024-6706 · Published Aug 8, 2024 · updated Jul 7, 2026
Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| open-webui PyPI | <= 0.1.105 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- CVE-2024-6706, PYSEC-2026-1722
More Open WebUI advisories
All Open WebUI| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerability High7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Open WebUI has vulnerable dependency on starlette via fastapiHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerabilityHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | Open WebUI Uncontrolled Resource Consumption vulnerabilityHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Oct 92024 | open-webui Insecure Direct Object Reference (IDOR) vulnerabilityMedium6.5Oct 9, 2024 | Medium6.5 | No fix yet |
| Oct 92024 | open-webui allows writing and deleting arbitrary filesMedium6.5Oct 9, 2024 | Medium6.5 | No fix yet |