Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored… (CVE-2026-109300)

The Open WebUI Markdown renderer in versions >=0.6.31 and <0.11.4 improperly handles user-authored tool-call detail blocks by treating them as tool output and mounting their embeds attribute in script-enabled iframes. This results in a stored cross-site scripting vulnerability (CVE-2026-109300) that allows authenticated users to inject JavaScript code via channel messages, chat messages, or citation content. The injected scripts execute in the context of other users' browsers, enabling attacks such as in-app phishing or session hijacking, particularly when iframeSandboxAllowSameOrigin is enabled.

An attacker with authenticated access can post crafted content that executes arbitrary JavaScript in the browsers of other users viewing that content. This can lead to in-app phishing attacks or session hijacking under certain iframe sandbox configurations. The vulnerability has a CVSS 3.1 score of 4.6 (medium severity), indicating limited confidentiality and integrity impact without denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent posting of crafted messages or citation content that could exploit this vulnerability. Review iframe sandbox configurations, specifically the iframeSandboxAllowSameOrigin setting, to limit potential session hijacking risks.