https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 17:49:45 +0000 https://vulnerability.circl.lu/vuln/cve-2026-26192 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat. Version 0.7.0 fixes the issue.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat. Version 0.7.0 fixes the issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-26192 https://vulnerability.circl.lu/vuln/pysec-2026-2769 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary Manually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document payload in a chat. The payload also executes when the citation is viewed on a shared chat.</p> <p>### Details The vulnerability stems from how iFrame are implemented here: https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/Citations/CitationModal.svelte#L163-L170 The `html` attribute can be controlled by a user who manually edits the chat history. Since `allow-scripts` and `allow-same-origin` are harcoded here the sandboxing offers essentially no protection.</p> <p>### PoC Create an arbitrary chat with a file upload attached: &lt;img width=&#34;2462&#34; height=&#34;1148&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fad83c74-036d-41b8-bc44-87bf2a538b21&#34; /&gt; Edit the response &lt;img width=&#34;768&#34; height=&#34;206&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/41a7342a-cc41-433e-8820-0bc6ed08ddd7&#34; /&gt; &lt;img width=&#34;2142&#34; height=&#34;796&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fb731111-e082-4172-80d1-34cff6b2a511&#34; /&gt; Before saving, configure the browser to use an HTTP proxy tool (Burp/Caido/ZAP) and intercept the save request. Find the object within the `history` and then `messages` objects (not the `messages`…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>### Summary Manually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document payload in a chat. The payload also executes when the citation is viewed on a shared chat.</p> <p>### Details The vulnerability stems from how iFrame are implemented here: https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/Citations/CitationModal.svelte#L163-L170 The `html` attribute can be controlled by a user who manually edits the chat history. Since `allow-scripts` and `allow-same-origin` are harcoded here the sandboxing offers essentially no protection.</p> <p>### PoC Create an arbitrary chat with a file upload attached: &lt;img width=&#34;2462&#34; height=&#34;1148&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fad83c74-036d-41b8-bc44-87bf2a538b21&#34; /&gt; Edit the response &lt;img width=&#34;768&#34; height=&#34;206&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/41a7342a-cc41-433e-8820-0bc6ed08ddd7&#34; /&gt; &lt;img width=&#34;2142&#34; height=&#34;796&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fb731111-e082-4172-80d1-34cff6b2a511&#34; /&gt; Before saving, configure the browser to use an HTTP proxy tool (Burp/Caido/ZAP) and intercept the save request. Find the object within the `history` and then `messages` objects (not the `messages`…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2769