The vulnerability permits a user with model creation rights to embed malicious JavaScript into a model’s description, which is stored and rendered when any user – including administrators – views the model in the chat UI. This stored cross‑site scripting can be used to hijack sessions, deface content, or exfiltrate data from the victim’s browser, compromising confidentiality and integrity of the affected users’ sessions.

Open WebUI is impacted when running any version earlier than 0.9.0. All instances of the open‑webui product that have not applied the 0.9.0 update are vulnerable, regardless of hosting environment, since the flaw exists in the core model description handling logic.

The CVSS score of 7.3 indicates a high severity, and while EPSS data is not available, the vulnerability is not yet listed in CISA KEV. An attacker must be authenticated and possess workspace.models permission, a role that is typically granted to content creators. Once a malicious model is created, any user who opens the chat UI with that model will execute the embedded script in their browser, indicating a probable attack vector of authenticated compromised user activity. The lack of remote code execution does not diminish the practical risk, as arbitrary JavaScript can manipulate page content, steal cookies or perform malicious actions on behalf of the victim.