CVE-2024-8017: XSS in open-webui

The impact of CVE-2024-8017 is significant due to the potential for privilege escalation and data theft. An attacker could inject JavaScript code into a tooltip displayed to a user, enabling them to steal chat history, delete existing conversations, and, critically, elevate their own account to administrator status if the victim holds administrative privileges. This could grant the attacker complete control over the open-webui instance. The ability to escalate to admin privileges makes this vulnerability particularly dangerous, as it bypasses standard access controls and allows for widespread compromise. The open-webui's reliance on user-supplied data without proper sanitization creates a direct attack vector for this XSS vulnerability.

1. Reserved2024-08-20
2. Published2025-03-20
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-8017 is to upgrade to a patched version of open-webui. Unfortunately, the specific patched version is not provided, so users should monitor the open-webui project's official channels for updates. As a temporary workaround, consider implementing strict Content Security Policy (CSP) headers to restrict the execution of inline scripts and limit the sources from which scripts can be loaded. Additionally, input validation and output encoding should be implemented to sanitize user-supplied data before it is rendered in HTML. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload into a tooltip and verifying that it is not executed.