GHSA-jwf8-pv5p-vhmc
HIGHGHSA-jwf8-pv5p-vhmc is a high-severity (CVSS 7.3) Cross-site Scripting (XSS) vulnerability in open-webui. O3 Security confirms whether GHSA-jwf8-pv5p-vhmc is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Open WebUI has stored XSS in Excel file preview
Real-World Exposure
open-webuiReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger.
Details
The function used to convert XLSX documents to HTML for preview does not perform any input validation or sanitisation for the generated HTML
https://github.com/open-webui/open-webui/blob/a7271532f8a38da46785afcaa7e65f9a45e7d753/src/lib/components/common/FileItemModal.svelte#L120-L133
XLSX attachments are processed by this function, converted to HTML with XLSX.utils.sheet_to_html before ultimately being assigned to the variable excelHtml. Later there is logic that causes this to be assigned directly to the DOM when the preview tab is selected.
https://github.com/open-webui/open-webui/blob/a7271532f8a38da46785afcaa7e65f9a45e7d753/src/lib/components/common/FileItemModal.svelte#L358-L400
PoC
A python script to generate a payload file is as follows:
import xlsxwriter
payload = '<img src=x onerror="alert(\'XSS Triggered by XLSX file\')">'
workbook = xlsxwriter.Workbook('xss_payload.xlsx')
worksheet = workbook.add_worksheet()
payload_format = workbook.add_format()
worksheet.write_rich_string('A1',
'This cell contains a hidden payload: ',
payload_format, payload
)
worksheet.write('A2', 'This is a safe cell.')
worksheet.write('B1', 'Column B')
workbook.close()
Upload the generated file as an attachment to a chat, open the file modal, and click preview. Observe the XSS triggers. <img width="2444" height="1386" alt="image" src="https://github.com/user-attachments/assets/8400efb0-ea6f-4878-abdb-4c2fe529241f" /> This same process can be triggered in shared chats, allowing the payload to be distributed to victims. <img width="2386" height="1646" alt="image" src="https://github.com/user-attachments/assets/d0eda49c-8fcf-4fc4-bbb0-c8951b0369c3" />
Impact
Any user can create a weaponised chat that can be shared and subsequently used to target other users.
Low privilege users are at risk of having their session taken over by a payload that reads their token from local storage and exfiltrates it to an attacker controlled server.
Admins are at risk of exposing the server to RCE via same chain described in GHSA-w7xj-8fx7-wfch.
Caveats
The file attachment in the shared chat must be opened and previewed to trigger the vulnerability.
Recommendation
Sanitise the generated HTML with DOMPurify before assigning it to the DOM.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | open-webui | all versions | 0.8.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for open-webui. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update open-webui to 0.8.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-jwf8-pv5p-vhmc is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-jwf8-pv5p-vhmc is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-jwf8-pv5p-vhmc. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-jwf8-pv5p-vhmc in your dependencies?
O3 detects GHSA-jwf8-pv5p-vhmc across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.