Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy serves that content from the Open WebUI origin, an authenticated user with access to a shared terminal server could host script on a previewed port and take over a victim's account when the victim opened the preview. This issue is fixed in version 0.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-09T22:18:47.710Z",
  "pubdate": "2026-09-09T22:18:47.710Z",
  "executiveSummary": "Open WebUI versions 0.8.11 through 0.11.1 contain a critical cross-site scripting (XSS) vulnerability stemming from improper iframe sandbox configuration.\nThe vulnerability exists in src/lib/components/chat/FileNav/PortPreview.svelte, where terminal port previews are rendered using an iframe sandbox policy that includes both 'allow-scripts' and 'allow-same-origin' directives.\nBecause the terminal proxy serves content from the primary Open WebUI origin, an authenticated attacker with access to a shared terminal server can inject malicious JavaScript into a previewed port.\nWhen a victim views the affected terminal port preview, the injected script executes within the context of the victim's session, leading to potential account takeover, session hijacking, or unauthorized actions performed on behalf of the victim.\nThe flaw allows attackers to bypass standard same-origin policy protections, resulting in a high-severity security risk for self-hosted instances where terminal sharing is enabled.\nThe issue is remediated in version 0.11.1, which mandates an update for all affected deployments to eliminate the improper iframe sandbox constraints.",
  "technicalDetails": "The vulnerability is localized within the src/lib/components/chat/FileNav/PortPreview.svelte component, which is responsible for rendering the output of terminal ports via an iframe.\nThe root cause is an insecure implementation of the HTML5 iframe sandbox attribute. By including both the 'allow-scripts' and 'allow-same-origin' keywords, the application explicitly permits the sandboxed content to execute scripts and retain access to the origin of the host document.\nBecause the terminal proxy serves the rendered content from the same origin as the Open WebUI application, the 'allow-same-origin' directive grants the framed content full access to the application's cookies, local storage, and session identifiers.\nAn authenticated user with the ability to influence content served on a terminal port can inject a malicious payload into the terminal output. When another user—potentially an administrator—navigates to the port preview within the Open WebUI interface, the browser loads the malicious payload into the iframe.\nThe attack flow proceeds as follows: 1) The attacker gains access to a terminal environment accessible via the Open WebUI proxy. 2) The attacker outputs a malicious script to the terminal stream. 3) The target user clicks the preview link in Open WebUI, triggering the rendering of the PortPreview.svelte component. 4) The iframe, configured with 'allow-scripts' and 'allow-same-origin', executes the attacker's payload. 5) The script executes within the victim's session context, enabling the attacker to perform unauthorized API calls, exfiltrate sensitive data, or seize control of the victim's account.\nThis vulnerability is particularly impactful because it breaks the isolation boundary between untrusted terminal output and the authenticated web application environment. The combination of 'allow-scripts' and 'allow-same-origin' effectively neutralizes the security benefits of the iframe sandbox, turning a display component into an execution vector for stored XSS.\nAffected versions include 0.8.11 through 0.11.0. Exploitation requires the attacker to be an authenticated user capable of initiating or interacting with a shared terminal server, though the impact is realized against any user—including those with higher privileges—who accesses the malicious preview."
}