CVE-2024-6706

MEDIUM

OpenWebUI - Cross-Site Scripting via Malicious Prompt

Title source: llm
STIX 2.1

Description

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0019
EPSS Percentile 40.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
openwebui/open_webui 0.1.105
pypi/open-webui 0PyPI
Published Aug 07, 2024
Tracked Since Feb 18, 2026