CVE-2026-109291: Open WebUI: stored XSS via citation URL steals tokens

HIGH

Published October 12, 2026

CISO Take

Open WebUI versions 0.6.33 through 0.11.3 contain a stored cross-site scripting flaw: an authenticated user can plant a javascript: URL in a citation's embed_url field, and it executes in the victim's session when the citation is clicked. Because the payload runs in the Open WebUI origin, it can read localStorage.token and act as the victim, including an administrator, which makes this an account takeover path (CVSS 7.3, high). Exploitation needs a low-privileged account and one click, and the attacker delivers the payload by sharing a crafted chat. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, and only 3 downstream dependents are tracked, but the package has 186 other CVEs, which points to a weak security track record. Upgrade to 0.11.4 or later, review shared chats for citations with javascript: URLs, and restrict chat sharing and account creation until you have patched.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High. The attack is network-based, low complexity and needs only a low-privileged account plus one user click (CVSS 7.3). Confidentiality and integrity impact are both high, because a stolen session token gives full impersonation. Risk rises sharply for multi-user deployments where admins view shared chats, since an admin token compromise can expose all users' conversations, API keys, connected model backends and configuration. Single-user, non-shared instances have much lower exposure. There is no known active exploitation, no KEV listing, no public exploit and no EPSS data, so likelihood is moderate for now. The simple, well-understood XSS technique makes weaponization easy once details are public.

How does the attack unfold?

Initial Access

Attacker with a low-privilege account creates a chat whose citation embed_url holds a javascript: payload and shares it with the target.

AML.T0093

User Execution

The victim clicks the citation, which is passed to window.open and runs the script in the Open WebUI origin.

AML.T0011.003

Credential Theft

The script reads localStorage.token and sends it to an attacker-controlled server.

AML.T0091.000

Impact

The attacker replays the token to impersonate the victim, reading chats and RAG data and changing settings or exposing API keys.

Initial Access

Attacker with a low-privilege account creates a chat whose citation embed_url holds a javascript: payload and shares it with the target.

AML.T0093

User Execution

The victim clicks the citation, which is passed to window.open and runs the script in the Open WebUI origin.

AML.T0011.003

Credential Theft

The script reads localStorage.token and sends it to an attacker-controlled server.

AML.T0091.000

Impact

The attacker replays the token to impersonate the victim, reading chats and RAG data and changing settings or exposing API keys.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Open WebUI	pip	—	No patch
156.7K3 dependentsPushed 6d ago76% patched~20d to patchFull package profile →

Do you use Open WebUI? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade open-webui (pip) to 0.11.4 or later. 2) Until patched, disable or restrict chat sharing, limit sign-ups, and avoid opening citations from shared chats created by untrusted users. 3) Add a strict Content Security Policy at the reverse proxy that blocks javascript: URL navigation where possible, and keep the Open WebUI origin separate from other sensitive apps. 4) Search the database for chats and citation records whose embed_url begins with javascript: (case-insensitive, allowing whitespace or encoding tricks), and review who shared them. 5) If you suspect abuse, force logout, rotate sessions and tokens, and rotate upstream API keys stored in Open WebUI. 6) Monitor for unusual API calls using one token from new IPs or user agents, and for admin actions that follow shared-chat views.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageAuth BypassSocial EngineeringFrameworkRAGAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application AML.T0067.000- Citations AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-109291?

Is CVE-2026-109291 actively exploited?

No confirmed active exploitation of CVE-2026-109291 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109291?

1) Upgrade open-webui (pip) to 0.11.4 or later. 2) Until patched, disable or restrict chat sharing, limit sign-ups, and avoid opening citations from shared chats created by untrusted users. 3) Add a strict Content Security Policy at the reverse proxy that blocks javascript: URL navigation where possible, and keep the Open WebUI origin separate from other sensitive apps. 4) Search the database for chats and citation records whose embed_url begins with javascript: (case-insensitive, allowing whitespace or encoding tricks), and review who shared them. 5) If you suspect abuse, force logout, rotate sessions and tokens, and rotate upstream API keys stored in Open WebUI. 6) Monitor for unusual API calls using one token from new IPs or user agents, and for admin actions that follow shared-chat views.

What systems are affected by CVE-2026-109291?

This vulnerability affects the following AI/ML architecture patterns: LLM chat front ends, RAG pipelines, Model serving gateways, Multi-user self-hosted AI platforms.

What is the CVSS score for CVE-2026-109291?

CVE-2026-109291 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

LLM chat front endsRAG pipelinesModel serving gatewaysMulti-user self-hosted AI platforms

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

AML.T0067.000Citations

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.

Exploitation Scenario

An attacker with a low-privilege account on a company's internal Open WebUI creates a chat whose citation embed_url contains a javascript: payload that reads localStorage.token and sends it to an attacker-controlled server. They share the chat with an administrator, saying it holds a useful answer with sources. The admin clicks the citation, the payload runs through window.open in the application's origin, and the token is exfiltrated. The attacker replays the token to authenticate as the admin, then reads other users' chats and RAG knowledge bases, extracts upstream LLM API keys and changes settings or tools.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.