CVE-2026-44549: Open WebUI has stored XSS in Excel file preview

May 8, 2026 (updated May 19, 2026)

Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheet_to_html to embed an XSS payload into the generated HTML. This is subsequently added to the DOM unsanitized via @html causing the payload to trigger.

References

github.com/advisories/GHSA-jwf8-pv5p-vhmc
github.com/open-webui/open-webui/security/advisories/GHSA-jwf8-pv5p-vhmc
nvd.nist.gov/vuln/detail/CVE-2026-44549

Code Behaviors & Features

Detect and mitigate CVE-2026-44549 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →