CVE-2026-109307

Craft CMS versions 5.0.0 before 5.10.14 are vulnerable to a DOM-based cross-site scripting (XSS) flaw within the control panel login and 2FA verification flow. The root cause is the improper handling of a user-controlled returnUrl parameter, which allows for the execution of javascript: URLs duri...

CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

EUVD-2026-97609

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300 Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109300

Open WebUI versions 0.6.31 through 0.11.4 are vulnerable to a stored cross-site scripting (XSS) flaw in the Markdown renderer . The root cause is that the renderer treats user-authored tool-call details blocks as tool output, mounting their embeds attribute in script-enabled iframes. An authentic...

CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109291 Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embedurl fields. Attackers can share a crafted chat whose citation, when clicked, is passed to...

CVE-2026-109291

Open WebUI versions 0.6.33 before 0.11.4 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly neutralize input, allowing authenticated users to store javascript: URLs within citation embed_url fields. An attacker can share a crafted chat where clic...

CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109290

Open WebUI versions 0.11.1 before 0.11.4 are susceptible to a stored cross-site scripting (XSS) vulnerability in the DocxPreview.svelte component. An authenticated attacker can execute arbitrary scripts by uploading a specially crafted DOCX attachment containing an OOXML altChunk HTML part or a s...

EUVD-2026-97592

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109290 Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109288

The Open WebUI software (versions before 0.11.4 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the MarkdownInlineTokens.svelte component. The root cause is the failure to validate URL schemes when rendering markdown link URLs into anchor hrefs. An authenticated user can embed java...

CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109288 Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

EUVD-2026-97590

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...