CVE-2026-26192: Open WebUI vulnerable to Stored XSS via iFrame in citations model

The citation preview in CitationModal.svelte treats a document as HTML when its metadata has an html flag, and shows it in an iFrame. The sandbox of that iFrame hardcodes allow-scripts and allow-same-origin, so it protects almost nothing. A logged-in user intercepts the save request for an edited chat, adds html: true to a source's metadata, and replaces the document text with a script payload.

The payload also runs when the victim opens the chat through a share link. The attacker needs only a low-privilege account and one victim who expands the sources and clicks the poisoned document, which the advisory lists as a caveat.

Script in the Open WebUI origin can read the session token from local storage and send it to an attacker's server, which takes over the victim's account. If the victim is an admin, the advisory says the same chain described in GHSA-w7xj-8fx7-wfch can lead to remote code execution on the server. For a team running Open WebUI in front of models and tools, one shared chat link can turn into an admin compromise.

Affected: pip package open-webui below 0.7.0 (the advisory says 0.6.43 and earlier). Any instance where users can create and share chats is exposed. Check the installed version:

pip show open-webui

For Docker, read the version in the Open WebUI admin settings, About page, or check the image tag you run.

Upgrade open-webui to 0.7.0.

pip install -U open-webui==0.7.0

For Docker, pull a newer image tag and recreate the container. The advisory lists no workaround and does not describe the code change. Until you upgrade, avoid opening shared chats from people you do not trust, and do not click citation sources in them.

Search stored chats for source metadata containing "html": true in the chat JSON, since normal use does not set that flag by hand. Check the chat history rows for messages whose edit came from a manual API save. Look in access logs for chat-update requests followed by shared-chat views. Watch for unexpected outbound requests from users' browsers to unknown hosts right after they open a shared chat, and review admin sessions that you cannot account for.

Summary

Manually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponised document payload in a chat. The payload also executes when the citation is viewed on a shared chat.

Details

The vulnerability stems from how iFrame are implemented here: https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/Citations/CitationModal.svelte#L163-L170 The html attribute can be controlled by a user who manually edits the chat history. Since allow-scripts and allow-same-origin are harcoded here the sandboxing offers essentially no protection.

PoC

Create an arbitrary chat with a file upload attached:

Edit the response

Before saving, configure the browser to use an HTTP proxy tool (Burp/Caido/ZAP) and intercept the save request. Find the object within the history and then messages objects (not the messages array) that contains the document source.

Add html: true to metadata, update the document to an XSS payload, and forward the request.

Observe the payload is rendered in the iFrame and the javascript executes.

The payload also executes when viewed from a shared version of the chat.

Impact

Any user can create a weaponised chat that can be shared and subsequently used to target other users.

Low privilege users are at risk of having their session taken over by a payload that reads their token from local storage and exfiltrates it to an attacker controlled server.

Admins are at risk of exposing the server to RCE via same chain described in https://github.com/advisories/GHSA-w7xj-8fx7-wfch.

Caveats

The victim must expand the sources and click the document containing the payload to trigger this issue.