Loading story…
Multiple high-severity vulnerabilities in Open WebUI allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from localStorage, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as allow-scripts allow-forms allow-same-origin. Reported impacts include exposure of DOM data, indexedDB, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources.
Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to remote code execution through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including v0.6.6 and v0.7.0 by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious data:text/html or javascript: embed payloads.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Open WebUI patched CVE-2026-26192 by making the iframeSandboxAllowSameOrigin setting optional and reducing the safer default sandbox to allow-scripts allow-forms. This addressed token theft and account takeover risks caused by attacker-controlled HTML rendered with same-origin iframe access.
A patch for CVE-2026-26193 changed Open WebUI's iframe handling so same-origin access is no longer always enabled when rendering embedded content in response messages. The vulnerability allowed attacker-controlled data:text/html payloads to execute in the parent origin context when an administrator viewed a malicious shared chat.
Open WebUI version 0.7.0 was affected by a stored XSS vulnerability in the CitationModal component due to iframe sandbox settings that included allow-same-origin. This allowed attacker-controlled JavaScript to access window.parent.localStorage and steal JWT session tokens for account takeover.
Open WebUI v0.6.6 corrected a stored XSS issue tied to HTML file handling under API file paths by validating that the file owner exists and has the admin role before serving content. The flaw could let a low-privileged user compromise an administrator and potentially execute commands on the host.
On 2025-05-05, a GitHub security advisory disclosed a stored XSS flaw in Open WebUI caused by unsafe HTML rendering in chat transcripts. The advisory said attackers could steal access tokens from localStorage, take over accounts, and potentially reach backend RCE by abusing administrative function creation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, CVE-2025-64495, has been identified in Open WebUI, a self-hosted AI web interface framework. The flaw is a stored DOM-based cross-site scripting (XSS) issue in the "Insert Prompt as Rich Text" feature, which allows attackers to inject malicious scripts. If exploited, this vulnerability can lead to remote code execution (RCE) with administrative privileges when an admin interacts with a crafted prompt, posing a significant risk to organizations using Open WebUI for managing AI workflows and data. Security researchers have published proof-of-concept (PoC) details and technical analysis demonstrating how the vulnerability can be leveraged to compromise the system. The issue highlights the importance of sanitizing user input in web applications, especially those handling sensitive AI operations. Administrators are urged to apply available patches and review their Open WebUI deployments to mitigate the risk of exploitation.
Jul 12, 2026
Security researchers have identified a critical vulnerability in Open WebUI, a self-hosted enterprise interface for large language models (LLMs), that allows attacker-controlled model servers to inject malicious code into enterprise environments. The flaw, tracked as CVE-2025-64496, stems from insecure handling of Server-Sent Events (SSE) when connecting to external model endpoints via the "Direct Connections" feature. Exploiting this vulnerability, attackers can execute arbitrary JavaScript in the browser context, steal JSON Web Tokens (JWTs), and, in some cases, escalate privileges to achieve remote code execution (RCE) on backend servers, potentially compromising entire AI workloads and sensitive enterprise data. The vulnerability affects Open WebUI versions up to and including 0.6.34 and has been addressed in version 0.6.35. Attackers can leverage the flaw by convincing users to connect to a malicious model endpoint, often under the guise of a "free GPT-4 alternative." Once exploited, the attacker gains persistent access to the victim's AI workspace, documents, chats, and embedded API keys. Security experts strongly recommend that organizations using Open WebUI update to the latest version immediately to mitigate the risk of exploitation and prevent unauthorized access to their AI infrastructure.
Jun 29, 2026
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026