CVE-2026-109291 in Open WebUI
Summary
by MITRE • 10/12/2026
Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.