CVE-2024-7990
Open WebUI stored cross-site scripting (XSS) vulnerability
CVE-2024-7990 has been rejected by its source and should not be treated as a live vulnerability, published March 20, 2025.
- Severity
- 8.4 HighCVSS 3.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
open-webuiPyPI | through 0.3.8 | None known |
open-webuiPyPI | through 0.3.8, plus listed versions 0.1.1240.1.1250.2.00.2.10.2.2 Show 11 moreShow less0.2.30.2.40.2.50.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7 | None known |
What each source reports
GitHub Advisories Score usedGHSA-gj27-76gq-5v3p
Open WebUI stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.
- Record
GHSA-gj27-76gq-5v3p- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-7990- Updated
- 2026-11-02
EUVDEUVD-2025-6916
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
EUVD-2025-6916- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
NVDNo score
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- Record
CVE-2024-7990- Updated
- 2026-11-02
OSV
Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.
- Record
CVE-2024-7990- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-gj27-76gq-5v3p
Open WebUI stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.
- Record
GHSA-gj27-76gq-5v3p- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-1734
Open WebUI stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.
- Record
PYSEC-2026-1734- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.