Summary
Open WebUI contains a stored cross-site scripting vulnerability in citation embed URLs. An authenticated user may store a script-bearing URL in a crafted chat, and a victim who interacts with the citation could have session data exposed or misused.
Open WebUI contains a stored cross-site scripting vulnerability in citation embed URLs. An authenticated user may store a script-bearing URL in a crafted chat, and a victim who interacts with the citation could have session data exposed or misused.
Affected context
The issue occurs in Open WebUI deployments where authenticated users can create or share chats containing citation records with attacker-controlled embed_url values. Risk increases when those values are opened in a browser context without sufficiently restricting URL schemes or isolating untrusted content from the application's origin.
The issue occurs in Open WebUI deployments where authenticated users can create or share chats containing citation records with attacker-controlled embed_url values. Risk increases when those values are opened in a browser context without sufficiently restricting URL schemes or isolating untrusted content from the application's origin.
Exploit preconditions
- Attack surface: Shared chat citations and citation embed links rendered in the web interface
- Required access: An authenticated account with the ability to create or influence citation data or shared chats
- Trigger point: A victim interacts with a crafted citation that is opened by the application
- Why exploitation is possible: Insufficient validation of the URL scheme allows active content to execute in the victim's application session
- Attack surface: Shared chat citations and citation embed links rendered in the web interface
- Required access: An authenticated account with the ability to create or influence citation data or shared chats
- Trigger point: A victim interacts with a crafted citation that is opened by the application
- Why exploitation is possible: Insufficient validation of the URL scheme allows active content to execute in the victim's application session
Why this happens
The vulnerability is caused by treating user-controlled citation URL data as a trusted navigation target. When an application accepts and opens arbitrary URL schemes without strict allowlisting, browser behavior can interpret the value as executable script rather than a passive external link. This is a stored cross-site scripting condition mapped to CWE-79: Improper Neutralization of Input During Web Page Generation, with the stored value later executed in a victim's browser context.
The vulnerability is caused by treating user-controlled citation URL data as a trusted navigation target. When an application accepts and opens arbitrary URL schemes without strict allowlisting, browser behavior can interpret the value as executable script rather than a passive external link. This is a stored cross-site scripting condition mapped to CWE-79: Improper Neutralization of Input During Web Page Generation, with the stored value later executed in a victim's browser context.
Potential impact
- An attacker may access sensitive browser-held session information
- A compromised session could allow actions to be performed as the victim
- User data, conversations, or connected resources could be exposed
- Administrative or privileged accounts could be impersonated if targeted
- An attacker may access sensitive browser-held session information
- A compromised session could allow actions to be performed as the victim
- User data, conversations, or connected resources could be exposed
- Administrative or privileged accounts could be impersonated if targeted
General mitigation guidance
Mitigation generally focuses on treating citation URLs as untrusted data and preventing active content from reaching browser navigation APIs.
Common defensive patterns include:
- Allowlisting only required passive URL schemes, such as HTTPS
- Rejecting executable or unexpected schemes during input validation
- Applying context-appropriate output encoding and URL canonicalization
- Avoiding direct use of untrusted values in browser-opening functions
- Isolating untrusted links or content from privileged application origins
- Limiting session token exposure through secure cookie and browser storage designs
- Applying least privilege to authenticated accounts and connected integrations
Mitigation generally focuses on treating citation URLs as untrusted data and preventing active content from reaching browser navigation APIs.
Common defensive patterns include:
- Allowlisting only required passive URL schemes, such as HTTPS
- Rejecting executable or unexpected schemes during input validation
- Applying context-appropriate output encoding and URL canonicalization
- Avoiding direct use of untrusted values in browser-opening functions
- Isolating untrusted links or content from privileged application origins
- Limiting session token exposure through secure cookie and browser storage designs
- Applying least privilege to authenticated accounts and connected integrations
How teams detect issues like this
Detection approaches commonly include:
- Static analysis rules for unsafe use of user-controlled values in navigation or window-opening APIs
- Code review checks for missing URL-scheme allowlists and incomplete canonicalization
- Tests covering stored values across creation, sharing, rendering, and interaction flows
- Content security policy monitoring for unexpected script execution or violations
- Policy enforcement that rejects active URL schemes in citation and embed fields
- Automated security review tools that identify untrusted data reaching browser sinks
Detection approaches commonly include:
- Static analysis rules for unsafe use of user-controlled values in navigation or window-opening APIs
- Code review checks for missing URL-scheme allowlists and incomplete canonicalization
- Tests covering stored values across creation, sharing, rendering, and interaction flows
- Content security policy monitoring for unexpected script execution or violations
- Policy enforcement that rejects active URL schemes in citation and embed fields
- Automated security review tools that identify untrusted data reaching browser sinks
