Open-WebUI Cross-Site Scripting Vulnerability Allowing Privilege Escalation and Data Theft

A cross-site scripting (XSS) vulnerability has been identified in Open-WebUI versions through 0.3.8. The issue arises in the tooltip HTML construction function, allowing attackers to execute actions with the victim's privileges. This could include stealing chat history, deleting chats, and escalating their account to admin status if the victim is an admin.

Impact

Exploitation of this vulnerability allows for cross-site scripting, with potential consequences including unauthorized actions taken on behalf of the victim, such as accessing or deleting chat history and manipulating account privileges.