VYPR
← All advisories
Critical severity9.0NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-8017

CVE-2024-8017

Description

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Openwebui/Open Webuillm-fuzzy3 versions
    <=0.3.8+ 2 more
    • (no CPE)range: <=0.3.8
    • (no CPE)range: unspecified
    • cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*range: <=0.3.8

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.