CVE-2024-7990

🗓️ 20 Mar 2025 10:08:55Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 68 Views🌐 WEB

Stored cross-site scripting vulnerability in open-webui version 0.3.8 allows code execution.

Reporter	Title	Published	Views	Family All 11
CNNVD	Open WebUI 跨站脚本漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui	20 Mar 202510:08	–	cvelist
EUVD	EUVD-2025-6916	3 Oct 202520:07	–	euvd
Github Security Blog	open-webui Vulnerable to Stored XSS via Model Description	8 May 202619:00	–	github
Github Security Blog	Open WebUI stored cross-site scripting (XSS) vulnerability	20 Mar 202512:32	–	github
NVD	CVE-2024-7990	20 Mar 202510:15	–	nvd
OSV	GHSA-GJ27-76GQ-5V3P Open WebUI stored cross-site scripting (XSS) vulnerability	20 Mar 202512:32	–	osv
Positive Technologies	PT-2025-12200 · Unknown · Open-Webui	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-7990	22 Mar 202512:35	–	redhatcve
Snyk	Cross-site Scripting (XSS)	20 Mar 202512:32	–	snyk

NVD

Node

openwebui open_webuiMatch0.3.8

[
  {
    "vendor": "open-webui",
    "product": "open-webui/open-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/2256e336-0f67-449e-a82d-7fc57081a21c

Parameter	Position	Path	Description	CWE
description	request body	/api/v1/models/add	Stored XSS via unsanitized model description in /api/v1/models/add might execute scripts when rendered.	CWE-79

21 Jul 2025 20:07Current

7.6High risk

Vulners AI Score7.6

CVSS 38.4

EPSS0.00293

SSVC

CWE-79