CVE-2026-26193: Open WebUI vulnerable to Stored XSS via iFrame embeds in response messages

In ResponseMessage.svelte, the iFrame for message.embeds hardcodes allowScripts and allowSameOrigin to true. That ignores the admin setting "iframe Sandbox Allow Same Origin". The embeds value comes from the stored chat, and a user can set it by intercepting the save request after editing a model response and adding an embeds key to the message object under history.messages.

The payload fires on page refresh and also in the shared-chat view, so one share link can reach every user on the instance. No click on a citation is needed. The victim only has to open the chat.

A payload can read the victim's token from local storage and send it to an attacker's server, which gives account takeover. An admin victim risks server RCE through the chain in GHSA-w7xj-8fx7-wfch, per the advisory. The attacker needs a normal account.

Affected: pip package open-webui 0.6.43 and earlier. Patched in 0.6.44. All deployments that allow chat editing and sharing are exposed, whatever the sandbox setting says.

pip show open-webui

For Docker, check the image tag or the version on the About page.

Upgrade open-webui to 0.6.44 or later.

pip install -U open-webui

For Docker, pull a newer image and recreate the container. The advisory lists no workaround and does not describe the patch. Note that CVE-2026-26192, a related citation XSS, needs 0.7.0, so moving to 0.7.0 or later covers both.

Look in stored chat JSON for message objects in history.messages that carry an embeds key you did not expect, especially on assistant responses that a user edited. Check access logs for chat-save requests that do not come from the normal UI, then for shared-chat views of the same chat. Unexpected browser requests to unknown hosts after users open shared chats can point to token exfiltration.

Summary

Manually modifying chat history allows setting the embeds property on a response message, the content of which is loaded into an iFrame with a sandbox that has allow-scripts and allow-same-origin set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. The result is a shareable link containing the payload that can be distributed to any other users on the instance.

Details

The flaw stems from how iFrames are constructed here: https://github.com/open-webui/open-webui/blob/6f1486ffd0cb288d0e21f41845361924e0d742b3/src/lib/components/chat/Messages/ResponseMessage.svelte#L689-L703

messages.embeds is a user controlled property and so can be arbitrarily set by the user to a payload of their choosing. Since allowScripts and allowSameOrigin are harcoded as true here the sandboxing offers essentially no protection.

PoC

Create an arbitrary chat:

Edit the model response:

Before saving, configure the browser to use an HTTP proxy tool (Burp/Caido/ZAP) and intercept the save request. Find the object within the history and then messages objects (not the messages array) that corresponds to the edited text.

On this object, add an embeds key and list value as shown below, forward the request and refresh the page.

This results in XSS via the controlled content getting rendered in the iFrame. Note the bold text is just to aid demonstration. console.log is used to prove JS execution because the lack of allow-modals on the iFrame sandbox prevents alerts.

The same payload triggers when the chat is shared.

Impact

Any user can create a weaponised chat that can be shared and subsequently used to target other users.

Low privilege users are at risk of having their session taken over by a payload that reads their token from local storage and exfiltrates it to an attacker controlled server.

Admins are at risk of exposing the server to RCE via same chain described in GHSA-w7xj-8fx7-wfch.