Vulnerability library
Security checkNovember 27, 2025

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

High severitynpmopen-webui

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when ‘Insert Prompt as Rich Text’ is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation.

Recommendation

Update the open-webui package to the latest compatible version. Followings are version details:

  • Affected version(s): <= 0.6.34
  • Patched version(s): 0.6.35

References

Could your website be exposed too?

SmartScanner can check your website for Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

These 7 PHP mistakes leave your website open to the hackers

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated November 27, 2025