CVE-2024-7990

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8

Description A stored cross-site scripting (XSS) issue exists, allowing an attacker to inject malicious scripts through the /api/v1/models/add endpoint, where the model description field is improperly sanitized. This can lead to arbitrary code execution by any user, including administrators.

Recommendations For open-webui/open-webui version 0.3.8, consider disabling access to the /api/v1/models/add endpoint until a patch is available, or ensure proper sanitization of the model description field to prevent script injection.