Количество 3
Количество 3
CVE-2026-45318
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview XSS (CVE-2026-44549). The same root cause — XLSX.utils.sheet_to_html() output rendered via {@html excelHtml} without DOMPurify — was reintroduced sometime after v0.8.0 and is exploitable again This vulnerability is fixed in 0.9.3.
GHSA-hcwp-82g6-8wxc
Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify)
BDU:2026-07458
Уязвимость функции DOMPurify.sanitize() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-45318 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview XSS (CVE-2026-44549). The same root cause — XLSX.utils.sheet_to_html() output rendered via {@html excelHtml} without DOMPurify — was reintroduced sometime after v0.8.0 and is exploitable again This vulnerability is fixed in 0.9.3. | CVSS3: 5.4 | 0% Низкий | 3 месяца назад |
| GHSA-hcwp-82g6-8wxc Open WebUI has stored XSS via unsanitized Office/Excel/DOCX file preview rendering ({@html} without DOMPurify) | CVSS3: 5.4 | 0% Низкий | 3 месяца назад |
 | BDU:2026-07458 Уязвимость функции DOMPurify.sanitize() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS) | CVSS3: 5.4 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу