CVE-2024-6706 Open WebUI Stored Cross-Site Scripting

2024-08-0723:01:15

CWE-79

KoreLogic

www.cve.org

open webui

cross-site scripting

cve-2024-6706

malicious prompt

javascript execution

EPSS

0.001

Percentile

17.7%

JSON

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Open WebUI",
    "repo": "https://github.com/open-webui/open-webui",
    "vendor": "Open WebUI",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.105"
      }
    ]
  }
]