CVE-2024-6706: Open WebUI prompt-driven XSS runs

Q: Is CVE-2024-6706 actively exploited?

No confirmed active exploitation of CVE-2024-6706 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2024-6706?

1) Upgrade open-webui (pip) to 0.3.14 or later. 2) Until patched, restrict access to trusted users and keep the instance off the public internet or behind SSO/VPN. 3) Add a strict Content-Security-Policy that blocks inline scripts at the reverse proxy. 4) Set session cookies to HttpOnly and SameSite, and rotate API keys and tokens stored in or reachable from Open WebUI. 5) Detect by reviewing chat logs and proxy logs for model responses containing script tags, event handlers or javascript: URIs, and for unusual API calls from user sessions. 6) Review the KoreLogic advisory KL-001-2024-005 for technical details.

Q: What systems are affected by CVE-2024-6706?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted LLM interfaces, Ollama/OpenAI-compatible gateways, RAG chat applications.

Q: What is the CVSS score for CVE-2024-6706?

CVE-2024-6706 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.66%.

CISO Take

Open WebUI before 0.3.14 renders model output in a way that lets a crafted prompt make the LLM emit content that executes arbitrary JavaScript in the user's browser (CWE-79). Exploitation needs user interaction, but the scope-changed CVSS 6.1 means script can run with the victim's session, including in admin accounts. Real-world urgency is moderate: EPSS is 0.66% (about the 49th percentile), there is no KEV listing, no public exploit and no Nuclei template. Blast radius is small by dependents (3), but the package has 188 other CVEs, which points to a weak security track record, so treat it as part of a wider hardening problem. Upgrade open-webui to 0.3.14 or later, and review any instance exposed to untrusted users or untrusted content, since session theft there could lead to model, API-key or data exposure.

Sources:NVDEPSSGitHub AdvisoryATLASOpenSSFkorelogic.com

What is the risk?

Medium overall. The attack is network-based, low complexity, needs no privileges and one user action (CVSS 6.1, scope changed). Exploitation likelihood is low to moderate (EPSS 0.00657, no KEV, no public exploit or scanner template). Risk grows for internet-facing or multi-tenant instances, shared chats, and admin users, because injected script runs with the victim's session and can reach the chat history, API keys and connected model backends.

How does the attack unfold?

Initial Access

Attacker crafts a prompt or plants content that coerces the LLM into emitting a script payload.

AML.T0051

Exploitation

The victim views the response and the unsanitized output executes JavaScript in the Open WebUI origin.

AML.T0077

Impact

Script steals session tokens and API keys and reads chat data, acting with the victim's privileges.

Initial Access

Attacker crafts a prompt or plants content that coerces the LLM into emitting a script payload.

AML.T0051

Exploitation

The victim views the response and the unsanitized output executes JavaScript in the Open WebUI origin.

AML.T0077

Impact

Script steals session tokens and API keys and reads chat data, acting with the victim's privileges.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	< 0.3.14	`0.3.14`
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.1 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade open-webui (pip) to 0.3.14 or later. 2) Until patched, restrict access to trusted users and keep the instance off the public internet or behind SSO/VPN. 3) Add a strict Content-Security-Policy that blocks inline scripts at the reverse proxy. 4) Set session cookies to HttpOnly and SameSite, and rotate API keys and tokens stored in or reachable from Open WebUI. 5) Detect by reviewing chat logs and proxy logs for model responses containing script tags, event handlers or javascript: URIs, and for unusual API calls from user sessions. 6) Review the KoreLogic advisory KL-001-2024-005 for technical details.

How is it classified?

Prompt InjectionCode ExecutionFrameworkModelAML.T0049- Exploit Public-Facing Application AML.T0051- LLM Prompt Injection AML.T0077- LLM Response Rendering

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MS-2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM01-Prompt InjectionLLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2024-6706?

Open WebUI before 0.3.14 renders model output in a way that lets a crafted prompt make the LLM emit content that executes arbitrary JavaScript in the user's browser (CWE-79). Exploitation needs user interaction, but the scope-changed CVSS 6.1 means script can run with the victim's session, including in admin accounts. Real-world urgency is moderate: EPSS is 0.66% (about the 49th percentile), there is no KEV listing, no public exploit and no Nuclei template. Blast radius is small by dependents (3), but the package has 188 other CVEs, which points to a weak security track record, so treat it as part of a wider hardening problem. Upgrade open-webui to 0.3.14 or later, and review any instance exposed to untrusted users or untrusted content, since session theft there could lead to model, API-key or data exposure.

Is CVE-2024-6706 actively exploited?

No confirmed active exploitation of CVE-2024-6706 has been reported, but organizations should still patch proactively.

How to fix CVE-2024-6706?

1) Upgrade open-webui (pip) to 0.3.14 or later. 2) Until patched, restrict access to trusted users and keep the instance off the public internet or behind SSO/VPN. 3) Add a strict Content-Security-Policy that blocks inline scripts at the reverse proxy. 4) Set session cookies to HttpOnly and SameSite, and rotate API keys and tokens stored in or reachable from Open WebUI. 5) Detect by reviewing chat logs and proxy logs for model responses containing script tags, event handlers or javascript: URIs, and for unusual API calls from user sessions. 6) Review the KoreLogic advisory KL-001-2024-005 for technical details.

What systems are affected by CVE-2024-6706?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted LLM interfaces, Ollama/OpenAI-compatible gateways, RAG chat applications.

What is the CVSS score for CVE-2024-6706?

CVE-2024-6706 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted LLM interfacesOllama/OpenAI-compatible gatewaysRAG chat applications

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0051LLM Prompt Injection

AML.T0077LLM Response Rendering

Compliance Controls Affected

EU AI Act: Art. 15

NIST AI RMF: MS-2.7

OWASP LLM Top 10: LLM01, LLM05

What are the technical details?

Original Advisory

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

Exploitation Scenario

An attacker crafts a prompt, or plants content such as a shared chat or a document the model ingests, that coerces the LLM into outputting an HTML/JavaScript payload. When a victim opens the conversation or the response renders, the script runs in the Open WebUI origin. It exfiltrates the session token and API keys, then uses the victim's privileges to read chats, change settings or reach connected model backends. If the victim is an administrator, the attacker can escalate to instance-wide data access.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.