CVE-2024-6706 Open WebUI Stored Cross-Site Scripting

2024-08-0723:01:15

CWE-79

KoreLogic

github.com

cve-2024-6706

open webui

stored cross-site scripting

attackers

malicious prompt

javascript execution

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

17.7%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

CNA Affected

[
  {
    "repo": "https://github.com/open-webui/open-webui",
    "vendor": "Open WebUI",
    "product": "Open WebUI",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.105"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:openwebui:open_webui:0.1.105:*:*:*:*:*:*:*"
    ],
    "vendor": "openwebui",
    "product": "open_webui",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.105"
      }
    ],
    "defaultStatus": "unknown"
  }
]