CVE-2026-26193

Deeper analysis

CVE-2026-26193 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting Open WebUI, a self-hosted artificial intelligence platform designed for offline operation. In versions prior to 0.6.44, attackers can manually modify chat history to set the `embeds` property on a response message. This property's content is then loaded into an iFrame with a sandbox attribute that includes `allow-scripts` and `allow-same-origin`, bypassing the "iframe Sandbox Allow Same Origin" configuration. The vulnerability impacts affected chats, including those in shared format.

The attack requires low privileges (PR:L), low attack complexity (AC:L), network access (AV:N), and user interaction (UI:R), with a CVSS v3.1 base score of 7.3 (C:H/I:H/A:N). An authenticated user with low privileges can craft a malicious payload by editing chat history, creating a shareable link that distributes the stored XSS payload to other users on the same instance. When victims access the shared chat or link, the payload executes in the sandboxed iFrame, potentially leading to high confidentiality and integrity impacts such as session hijacking, data theft, or further compromise within the user's browser context.

The GitHub security advisory (GHSA-vjm7-m4xh-7wrc) and related code changes confirm that updating to version 0.6.44 resolves the issue by addressing the improper iFrame sandbox handling. No additional mitigations are specified beyond applying the patch.

This vulnerability is notable in the context of self-hosted AI platforms, where shared chat links could propagate exploits across user bases in collaborative or multi-tenant deployments, though no public evidence of real-world exploitation has been reported.