| Component | Open WebUI |
| Severity | high (CVSS 7.3) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N |
| Published (NVD) | 2025-11-08 |
| Last modified | 2026-06-17 |
| Affected versions | open_webui < 0.6.35 |
| Fixed in | 0.6.35 |
| Weakness | CWE-95CWE-501CWE-829CWE-830 |
| CISA KEV | not listed |
NVD description
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.
What to do
- Upgrade Open WebUI to
0.6.35or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2025-64496
- https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca
- https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx
Read more
Other Open WebUI CVEs
Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR...
Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in...
Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro...
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea...
Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base...
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir...