CVE-2026-109288

The Open WebUI software (versions before 0.11.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the MarkdownInlineTokens.svelte component. The root cause is the failure to validate URL schemes when rendering markdown link URLs into anchor hrefs. An authenticated user can embed java...

EUVD-2026-97590

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...