CVE-2025-65959

🚨 An authenticated user can turn a simple Markdown file into a sneaky attack vector! This Stored XSS vulnerability in Open WebUI's Notes PDF download feature is like inviting someone to dinner, only to have them sneak in a rogue recipe that serves up your data! ⚡ Think of the vulnerability like a houseguest who brings food that looks delicious, but actually contains hidden ingredients that can make you sick. An attacker can craft a harmless-looking Markdown file, but once it’s downloaded, it can execute malicious JavaScript that steals session tokens, putting both admin and regular users at risk. If this vulnerability is exploited, attackers can run arbitrary JavaScript code as users download notes, allowing them to snatch session tokens! This could lead to unauthorized access to sensitive data, making it a high-stakes game for anyone using this platform. You wouldn’t want a thief in your kitchen, would you?

If this vulnerability is exploited, attackers can run arbitrary JavaScript code as users download notes, allowing them to snatch session tokens! This could lead to unauthorized access to sensitive data, making it a high-stakes game for anyone using this platform. You wouldn’t want a thief in your kitchen, would you? To protect yourself, immediately upgrade Open WebUI to version 0.6.37 or later! Additionally, conduct a thorough review of your Markdown import processes to ensure no harmful content slips through. Regular security audits can help catch these sneaky vulnerabilities! You've got this! With a quick update and vigilance, you'll keep your environment safe and sound. 🛡️