Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Description

The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when ‘Insert Prompt as Rich Text’ is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation.

Recommendation

Update the open-webui package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.6.34
• Patched version(s): 0.6.35

References

• GHSA-w7xj-8fx7-wfch
• CVE-2025-64495
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF - CVE-2025-65959
• open-webui Vulnerable to Stored XSS via Model Description - CVE-2026-44721
• Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
• TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661

You might also like:

These 7 PHP mistakes leave your website open to the hackers

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

Tags:

npm

open-webui