CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
Authenticated attackers can execute scripts via crafted citations to steal session tokens and take over victim accounts in Open WebUI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-109291?
CVE-2026-109291 is a high-severity cross-site scripting vulnerability in open-webui, published on 12 Oct 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.
Weakness: CWE-79
Which versions are affected by CVE-2026-109291?
How do I fix CVE-2026-109291?
No fix has been published for CVE-2026-109291 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-109291 being exploited?
There is no known exploitation of CVE-2026-109291 in the wild and no public exploit code.
Sources
Also known as GHSA-g5hc-j8wv-8p98, GHSA-qpqv-xwg8-cqpj.