CVE-2024-7990
| CVE ID | CVE-2024-7990 |
| Vendor Disposition | Rejected, not a vulnerability |
| Published | 2025-03-20 |
| Issuing CNA | huntr / Protect AI (from a bounty report) |
| Claimed Severity | High (CVSS 8.4, CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) |
Timeline
Open WebUI rejects this record as not a vulnerability; the assessment below is the project's official position. The issuing CNA has not responded and has not acted on the record, so the dispute has been escalated to the CVE Program Root.
| Date | Event |
|---|---|
| 2025-03-20 | huntr / Protect AI publishes the CVE. |
| 2026-07-22 | Open WebUI publishes this disposition, rejecting the report as not a vulnerability. |
| 2026-07-22 | Open WebUI contacts huntr / Protect AI directly to dispute the record. |
| 2026-08-03 | Open WebUI follows up with huntr / Protect AI. No response is received and the record is unchanged. |
| 2026-08-08 | With no response from huntr / Protect AI, Open WebUI escalates this record to the CVE Program Root. |
As of 2026-08-08, the record is still in the PUBLISHED state on cve.org and the dispute is before the CVE Program Root. This disposition stands as Open WebUI's official assessment.
Disclosure Pathway
No report corresponding to this CVE was filed through the project's official reporting channel (GitHub Security Advisories) prior to publication.
What the CVE Claims
In Open WebUI v0.3.8, the description field submitted to POST /api/v1/models/add is claimed to be rendered in chat without sanitization, so a stored script payload would execute for any user who views it, including administrators. The record classifies this as CWE-79 (stored cross-site scripting) and scores it CVSS 8.4 (High).
Why This Is Not a Vulnerability
The report is wrong on two independent grounds, each sufficient on its own, and both are verifiable in the code.
The Field Is Admin-Only
POST /api/v1/models/add and POST /api/v1/models/update require Depends(get_admin_user). A non-administrator cannot create or edit a model, and therefore cannot set the description field at all. The report's premise that "an attacker can inject" a payload is false: only an administrator can write this field. The record's own CVSS vector concedes this with PR:H (high privileges required). Administrator-authored content rendering inside the administrator's own single-trust-domain, admin-governed instance is administrator authority, not a cross-privilege scripting vulnerability.
The Output Is Escaped Anyway
Even setting access control aside, the chat render path passes the value through sanitizeResponseContent, which entity-escapes < and > (.replaceAll('<', '<').replaceAll('>', '>')). A <script> payload is rendered as inert text, never executed. The claimed script execution does not occur.
CWE-79 Does Not Hold
Stored cross-site scripting requires input that an attacker can control reaching a page unescaped. Here the input is not attacker-controllable (it is admin-only) and it is escaped on output. Neither condition of CWE-79 is met.
Severity
Because the field is administrator-only and the output is escaped, no CVSS score applies. The record's own PR:H already concedes that only an administrator can reach the field, and the 8.4 (High) with S:C/C:H/I:H/A:H describes an impact that cannot occur.
Applicable Security Policy Rules
- Rule 1: Expected behavior. Administrator-authored, output-escaped content crosses no security boundary.
- Rule 9: Setting a model description is an administrator action, and administrator actions are out of scope.
Impact to Users
No action required. The model description field is writable only by administrators, and its content is entity-escaped before rendering, so the reported script injection cannot occur.