← CVE Intelligence

CVE-2026-45318

Open WebUI: Stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) PUBLISHED

Description (CNA)

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview XSS (CVE-2026-44549). The same root cause — XLSX.utils.sheet_to_html() output rendered via {@html excelHtml} without DOMPurify — was reintroduced sometime after v0.8.0 and is exploitable again This vulnerability is fixed in 0.9.3.

Affected (CNA)

Vendor / productVersions
open-webui / open-webuiaffected < 0.9.3

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.