Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working payload was validated through the Markdown preview path, resulting in JavaScript execution in the victim’s browser under the application origin. This vulnerability is fixed in 0.9.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-54011 Cross-Site Scripting via Unsafe Mermaid Rendering in Open WebUI Before 0.9.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54011
Post summary
The entry announces a new XSS vulnerability (CVE‑2026‑54011) in Open WebUI (prior to v0.9.6) caused by unsafe Mermaid rendering, but it offers no PoC, exploit, patch, or indication of active abuse.
🚨High - Open WebUI: Stored XSS + Forged meta.knowledge Cross-User File Access (CVE-2026-54011, CVE-2026-54012) Two high-severity flaws were disclosed in Open WebUI, the popular self-hosted interface for running local and remote LLMs. The first (CVE-2026-54011) is a stored XSS: the Markdown file preview renders Mermaid diagrams with securityLevel: 'loose' and injects the generated SVG into the DOM via innerHTML, so a malicious .md file with a crafted Mermaid block - e.g. a click directive pointing to a javascript: URI - runs arbitrary JavaScript under the app origin when a low-privileged user opens the file and clicks. The second (CVE-2026-54012) is an access-control bypass: Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge file entries without checking ownership, then trusts those entries as authorization in the built-in view_file tool and has_access_to_file(). An attacker with workspace.models permission and a victim's file ID can read the file's extracted text, pull its content via GET /api/v1/files/{id}/content, and delete it via DELETE /api/v1/files/{id} - with no user interaction. 👉Both affect Open WebUI <= 0.9.5; upgrade to 0.9.6.
Post summary
Both CVE-2026-54011 and CVE-2026-54012 are high‑severity flaws in Open WebUI—a stored XSS and an access‑control bypass—disclosed with technical details, and the vendor recommends upgrading to 0.9.6.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openwebui | open_webui | - | - | - |