CVE-2026-4992

Vulnerability

Overview

A flaw in wandb OpenUI up to version 1.0 allows unauthenticated HTML injection via the create_share and get_share endpoints in backend/openui/server.py. The id argument is not validated, and the application fails to sanitize HTML input before saving or rendering it. This enables an attacker to inject arbitrary HTML or JavaScript into shared components [1].

Attack

Vector

The attack is performed remotely without authentication. The share endpoints lack the authentication middleware, unlike other endpoints such as chat_completions which verify the user session. An attacker can craft a request to create or overwrite a shared component by supplying a malicious html field in the JSON payload. The id parameter is attacker-controlled, allowing overwrite of any existing share by guessing or knowing the ID [1].

Impact

When a victim views the compromised share link, the injected script executes within an iframe that has allow-same-origin permissions. This allows the script to access parent.document.cookie, exposing the victim's session token. Successful exploitation leads to session hijacking and full account takeover [1].

Mitigation

The vendor was contacted but did not respond. No official patch is available as of the publication date. Users should restrict access to the OpenUI instance or implement external authentication and input sanitization until a fix is available [1].