The vulnerability in Open WebUI (CVE-2026-26193) is a stored XSS caused by improper sandboxing of iFrames used to render user-controlled embeds in chat response messages. The embeds property can be arbitrarily set by users by intercepting and modifying the chat history save request, injecting malicious content that executes JavaScript within the iFrame. The sandbox attribute on the iFrame includes allow-scripts and allow-same-origin, which negates the sandbox's security benefits, allowing script execution and access to the same origin context. This enables attackers to craft chats that execute malicious scripts in other users' browsers when viewing the chat or its shared link. The vulnerability affects Open WebUI versions before 0.6.44. There is no vendor advisory or patch link provided, so remediation status is unknown.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of other users' browsers on the same Open WebUI instance. This can lead to theft of session tokens from local storage, enabling account takeover of low-privilege users. Additionally, administrators may be at risk of remote code execution (RCE) through a chained exploit as referenced in related advisories. The vulnerability enables creation and sharing of weaponized chats that propagate the attack to other users. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid manually modifying chat history or injecting embeds in response messages. Restrict user permissions to prevent unauthorized modification of chat data. Monitor for updates from the Open WebUI project regarding patches addressing this vulnerability.