The vulnerability in Open WebUI (<0.7.0) arises from the ability of users to manually edit chat history and set the 'html' property within document metadata. This causes the frontend to treat document contents as HTML and render them inside an iFrame with 'allow-scripts' and 'allow-same-origin' permissions, effectively disabling sandbox protections. As a result, stored XSS payloads embedded in chat documents execute JavaScript when the citation is previewed or viewed in shared chats. The attack vector requires user interaction to expand and click the malicious document. The impact includes session token theft for regular users and potential server-side RCE exposure for admins when chained with a related vulnerability (GHSA-w7xj-8fx7-wfch).

An attacker with the ability to modify chat history can create weaponized chats containing malicious HTML payloads that execute JavaScript in the context of other users viewing the citation. This can lead to theft of session tokens from local storage, enabling account takeover for low-privilege users. Additionally, administrators are at risk of remote code execution on the server if this vulnerability is chained with a known related vulnerability. The attack requires victim interaction (expanding and clicking the malicious document) to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid manually modifying chat history to include untrusted HTML content. Users should exercise caution when expanding and clicking documents in shared chats. Monitoring for updates from the Open WebUI project is recommended to apply any forthcoming patches addressing this issue.