PT-2026-41176 · Unknown · Open-Webui

Published 2026-05-10 · Updated 2026-05-16 · CVE-2026-45346

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.31

Description A Cross-Site Scripting issue exists in the SVG renderer implementation. This allows the permanent storage of HTML or JavaScript code within the application, which is then executed in the context of the application domain. An attacker can use this to extract sensitive data, manipulate the DOM tree, or perform complex client-side attacks, potentially leading to account takeover if a malicious thread is shared with other users or administrators.

Recommendations Update to version 0.6.31.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

BDU:2026-07135

CVE-2026-45346

GHSA-R29H-37FJ-X2W6

Affected Products

Open-Webui

References · 8

• 🔥 https://github.com/open-webui/open-webui/security/advisories/GHSA-r29h-37fj-x2w6 · Exploit
• https://osv.dev/vulnerability/GHSA-r29h-37fj-x2w6 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07135 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45346 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://t.me/CVEtracker/53983 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2055459607665922459 · Twitter Post
• https://twitter.com/CVEnew/status/2055457501370265707 · Twitter Post