The defect permits arbitrary script injection into the HTML rendering view of Open WebUI. The system stores the malicious HTML in a chat’s content and later renders it inside an iframe whose sandbox directive includes allow‑scripts, allow‑forms, and allow‑same‑origin, effectively granting the injected code execution and parent‑context access. This stored XSS can exfiltrate information stored in the parent page’s local storage, modify DOM content, or execute other malicious actions, representing a significant confidentiality and integrity risk.

Open WebUI (open-webui:open-webui) versions preceding 0.6.5 are vulnerable. The issue was addressed in release 0.6.5 and later.

The CVSS score of 7.7 classifies this as a high‑severity flaw. With no EPSS data available and no listing in CISA’s KEV catalog, exploitation likelihood is undetermined but the vulnerability can be leveraged by any entity that can cause malicious content to be stored within a chat. The exploit path involves injecting a payload into a chat, storing it, and then triggering the rendering view to execute the payload with elevated privileges owing to the sandbox’s allow‑scripts flag. Once executed, the attacker can manipulate the parent context, including reading local storage data, thereby compromising the application’s integrity and potentially its users’ sensitive data.