CVE-2026-45318Disclosure(openwebui / open_webui)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview XSS (CVE-2026-44549). The same root cause — XLSX.utils.sheet_to_html() output rendered via {@html excelHtml} without DOMPurify — was reintroduced sometime after v0.8.0 and is exploitable again This vulnerability is fixed in 0.9.3.

openwebui CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

open_webui

Threat summary

2 mentions across 1 observed day

What's happening

Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

openwebui

Products

open_webui

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds146d
Disclosure
CVE-2026-45318 Cross-Site Scripting Regression in Open WebUI Versions Be... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45318 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet announces CVE-2026-45318 as a Cross‑Site Scripting regression in Open WebUI, but offers no further technical or mitigation details.
0000063
4.0K followersView on X
CVE@CVEnew146d
General
CVE-2026-45318 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Ex… https://www.cve.org/CVERecord?id=CVE-2026-45318
Post summary
The post only references the CVE record URL without providing any additional details about the vulnerability, its exploitation, or remediation.
00000146
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openwebui	open_webui	-	-	-

Explore more

Back to dashboard openwebui CVEs open_webui vulnerabilities