An authenticated user can execute arbitrary code in the browser of other users by injecting a weaponized document payload into a chat, leading to stored Cross-site Scripting.

The application fails to neutralize input within the document metadata html property, allowing an authenticated attacker to craft malicious payloads that execute when a citation is previewed or a chat is shared.

The vulnerability carries a CVSS score of 7.3, reflecting its potential for significant impact on user session integrity and data confidentiality. Successful exploitation allows an attacker to perform actions on behalf of other users, potentially leading to the theft of session tokens, unauthorized access to sensitive chat history, or the redirection of users to malicious content.

Immediate Action: Upgrade the Open WebUI platform to version 0.7.0 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web access logs for unusual document uploads or suspicious requests targeting the citation preview endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS patterns in file uploads and metadata fields.

Public Exploit Available: No (exploit_available: false)

Given the potential for unauthorized code execution and session compromise, administrators should prioritize updating to version 0.7.0 immediately. Organizations utilizing Open WebUI in multi-user environments face heightened risk, as the vulnerability affects both individual chat sessions and shared chat interactions.