CVE-2026-44549
HighSummary
Open WebUI is a self-hosted artificial intelligence platform that prior to version 0.8.0 previewed Excel file attachments in an unsafe manner. A crafted XLSX file payload could exploit the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML.
Risk Assessment
Exploitation of this vulnerability could lead to the injection of malicious JavaScript code into the application, posing a serious threat to user data security.
Recommendation
It is recommended to upgrade Open WebUI to version 0.8.0 or later to mitigate this vulnerability.
Original NVD description (English source)
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger. This vulnerability is fixed in 0.8.0.