UpHeron
All vulnerabilities

Servers and applications

CVE-2024-8017

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.

Severity
Critical 9.0
Published
20 Mar 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Open WebUIServers and applications · cpe:a:openwebui:open_webui
  • Every version up to 0.3.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-8017
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-8017