Open WebUI (self‑hosted AI platform) allows a malicious user to edit chat history and set the HTML property inside document metadata. When this property exists, the frontend renders the document content as an iframe‑embedded HTML page. The stored payload can then be executed each time the citation is previewed, including when the chat is shared publicly. This flaw results in a stored XSS vulnerability that can run arbitrary scripts in the victim’s browser without additional user interaction.

Open WebUI (open‑webui) versions prior to 0.7.0 are affected. Any deployment of the platform that permits manual chat history editing or the inclusion of custom metadata may be vulnerable until an update is applied.

The CVSS score of 7.3 indicates a high impact potential. Although the EPSS score is below 1%, the existence of the vulnerability in a widely used self‑hosted solution keeps the risk alive. The CISA KEV catalog does not list this issue, but that does not negate the attack surface. An attacker needs the ability to edit the chat history or inject content into a document. Once the attack vector is established, the stored script will covertly execute in any user’s browser that opens the citation, including users who view shared conversations. The scope is primarily client‑side code execution, potentially exposing session information, facilitating credential theft, or delivering other malicious actions on the victim’s behalf.