CVE-2026-54011

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6

Description The application renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely. This allows for stored Cross-Site Scripting (XSS), where a malicious Markdown file can execute JavaScript in the victim's browser under the application origin.

Recommendations Update to version 0.9.6.