CVE-2025-64496
High · 7.3Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
CVSS
7.3
EPSS
7.2%
Published
Nov 7, 2025
CISA due date
—
The record
Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) `execute` events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | open-webui | 0 | 0.6.35 |
| npm | open-webui | 0 | 0.6.35 |
Related vulnerabilities
- GHSA-cm35-v4vp-5xvx Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via… Same vulnerability
- CVE-2026-44721 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… Also affects open-webui
- GHSA-gf5m-wcrh-7928 open-webui Vulnerable to Stored XSS via Model Description Also affects open-webui
- GHSA-c6xv-rcvw-v685 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing… Also affects open-webui
- CVE-2025-65958 Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing… Also affects open-webui
- GHSA-frv8-gffc-37px open-webui is Vulnerable to Incorrect Access Control Also affects open-webui
- CVE-2025-63681 open-webui is Vulnerable to Incorrect Access Control Also affects open-webui
- GHSA-w7xj-8fx7-wfch Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is… Also affects open-webui