Open WebUI’s AccountPending.svelte component incorrectly applies DOMPurify after converting user‑configurable "Pending User Overlay Content" with marked.parse() and inserting it into the page with {@html}. This ordering flaw allows an administrator to persist malicious JavaScript that executes in the browser context of any pending user who visits the overlay page. The injected code runs with the user's privileges but does not provide server‑side code execution or persistence beyond the browser.

The vulnerability is present in open‑webui platform releases earlier than 0.9.0. All users running any 0.x version before this update are affected.

The CVSS score of 4.8 indicates moderate risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an administrator to inject malicious content into the overlay configuration; after that, any pending user who views the overlay can be compromised through client‑side code execution.