CVE-2024-6706

Open WebUI Stored Cross-Site Scripting

CVSS 6.3 MEDIUMEPSS 0.6%CWE-79

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products

Open WebUI · Open WebUI

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://seclists.org/fulldisclosure/2024/Aug/3 https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt http://www.openwall.com/lists/oss-security/2024/08/08/6