mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-06 19:08:59 -05:00
[GH-ISSUE #21858] issue: XSS attack vector #58260
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#58260
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Mywk on GitHub (Feb 25, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/21858
Issue
HTML output is escaped in chat but rendered in the completion notification, creating inconsistent sanitization behavior and a potential XSS vector.
Environment
Expected Behavior
Chat messages and completion notifications should use the same sanitization/rendering logic.
Actual Behavior
<table>...</table>) is escaped and shown as literal text.This indicates inconsistent rendering/sanitization paths and creates a potential XSS attack surface.
Partially related: #9807 (HTML not rendered in chat).
Steps to Reproduce
glm-ocr).Convert this data to an HTML table and output only <table>...</table>.Screenshots
@Classic298 commented on GitHub (Feb 25, 2026):
If both are yes - file a security case here https://github.com/open-webui/open-webui/security
If no, then this is not a vulnerability.
After all, the model can also create artifacts which render HTML on the side with HTML and CSS and JS and can theoretically do XSS there too. But if the attack vector is "I myself have to tell the model to write that" then that's not an attack vector that's just intended behaviour. If you tell the model to do that, then it will do that.
The fact alone that the notifications are rendered differently doesn't constitute an XSS vulnerability.
Please check our security vulnerability requirements at https://github.com/open-webui/open-webui/security
@Mywk commented on GitHub (Feb 25, 2026):
Same behavior on latest version. I tested several payloads and no JavaScript was executed, so it does not appear to cross a security boundary under the default configuration.
One question though: if self-XSS via model output is considered expected behavior, what makes issue #9807 different? In both cases the model outputs HTML at the user's request and here it is simply rendered inconsistently between chat and notification, with the notification literally rendering the table.
If this behavior is intended and properly sanitized, feel free to close the issue.
@Classic298 commented on GitHub (Feb 25, 2026):
@Mywk i cannot definitely answer that question since the issue you reference is very old and the codebase around html rendering and JS execution likely looked different back then.
CC @tjbck
@Mywk commented on GitHub (Feb 25, 2026):
No worries, updated everything on my end and made a proper issue for the rendering inconsistency. Thank you!