CVE-2026-4995

The vulnerability resides in the annotator iframe of OpenUI (version 1.0 and earlier). The iframe receives LLM-generated HTML and JavaScript via postMessage from the parent frame, then directly sets wrapper.innerHTML (line 566) and creates ` elements with arbitrary code (lines 591–598) without any sanitization [1]. Additionally, the iframe's sandbox attribute includes both allow-same-origin and allow-scripts`, which is a known anti-pattern that allows scripts inside the iframe to fully access the parent frame's DOM, cookies, and session storage [1].

To exploit the vulnerability, an attacker must control the LLM response—either by compromising the LLM provider, performing a man-in-the-middle attack, or crafting a malicious input that the LLM reflects unsanitized. When a user triggers a UI component generation, the malicious HTML and JavaScript are delivered to the annotator iframe and executed in the user's browser [1]. The attack is fully remote and requires no special user privileges beyond using OpenUI.

Successful exploitation enables arbitrary client-side code execution within the security context of the OpenUI application. This can lead to session hijacking, theft of authentication tokens, and full account takeover [1].

The vendor was contacted but did not respond, and no official patch is available as of the publication date. Users are advised to restrict iframe sandbox permissions (remove allow-same-origin) or implement input sanitization (e.g., DOMPurify) on LLM responses as a temporary workaround [1].