CVE-2024-8017

Cross-site Scripting (XSS) in open-webui/open-webui

State: Published
Severity: 9.0 Critical
Published: Mar 20, 2025
Updated: Mar 20, 2025
Reserved: Aug 20, 2024

Description

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.

Scores

CVSS	Score	Vector	Source
3.0	9.0 Critical	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H	@huntr_ai

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
open-webui/open-webuiopen-webui	latest and earlierAffected

References

https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.