Количество 3
Количество 3
CVE-2026-44549
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. This vulnerability is fixed in 0.8.0.
GHSA-jwf8-pv5p-vhmc
Open WebUI has stored XSS in Excel file preview
BDU:2026-09669
Уязвимость функции sheet_to_html() веб-интерфейса на базе искусственного интеллекта Open WebUI, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-44549 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. This vulnerability is fixed in 0.8.0. | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
| GHSA-jwf8-pv5p-vhmc Open WebUI has stored XSS in Excel file preview | CVSS3: 7.3 | 0% Низкий | 3 месяца назад |
 | BDU:2026-09669 Уязвимость функции sheet_to_html() веб-интерфейса на базе искусственного интеллекта Open WebUI, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS) | CVSS3: 8.7 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу