Open WebUI versions between 0.6.31 and before 0.11.4 contain a stored cross‑site scripting flaw in the Markdown renderer. The renderer treats user‑authored tool‑call details blocks as output and mounts their embeds attribute in script‑enabled iframes. As a result, authenticated users can post crafted channel, chat, or citation messages that execute JavaScript in the browsers of viewers, enabling in‑app phishing or session hijacking when the iframe sandbox allows same‑origin content.

Any installation of Open WebUI (open-webui:open-webui product) running a version dated 0.6.31 up to but excluding 0.11.4 is affected. The vulnerability manifests in channel messages, chat logs, or citation content that contains tool‑call blocks, so any environment where such content can be posted is at risk.

The vulnerability receives a CVSS score of 5.1, indicating moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with permission to post content, and the attack vector is through crafted messages that embed malicious code. Users with ordinary reading privileges are impacted when they view the malicious content, leading to potential loss of session integrity or phishing of credentials. Because the vulnerability hinges on user‑generated content, social engineering can facilitate exploitation. The lack of publicly available exploit code and the absence from KEV suggest the risk is limited, but patching is recommended.