Is CVE-2025-64495 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64495 being exploited in the wild.

How severe is CVE-2025-64495?

Low severity, with a CVSS score of 3.1, published 7 July 2026.

Which products and versions are affected?

open-webui (npm) SEMVER:introduced=0,fixed=0.6.35; open-webui (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.35.

Is there a fix for CVE-2025-64495?

Yes. open-webui (npm): upgrade to 0.6.35 or later; open-webui (PyPI): upgrade to 0.6.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64495 attacked?

It is attacked over the network.

Am I affected by CVE-2025-64495?

Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64495: Open WebUI stored DOM XSS in prompts with Rich Text insertion

CVE-2025-64495 · Severity: low · CVSS 3.1 · Published 2026-07-07

Open WebUI is a web interface for managing AI models and chatbots. When the 'Insert Prompt as Rich Text' setting is enabled, an attacker with prompt creation permissions can inject malicious JavaScript code that executes in the browser of any user who runs the prompt command. This can lead to account takeover through session token theft or, for administrators, remote code execution on the server via Python function execution.

Technologies: open-webui (npm), open-webui (PyPI). Vendors: npm, PyPI.

Quick answers

Is CVE-2025-64495 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64495 being exploited in the wild.
How severe is CVE-2025-64495?: Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?: open-webui (npm) SEMVER:introduced=0,fixed=0.6.35; open-webui (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.35.
Is there a fix for CVE-2025-64495?: Yes. open-webui (npm): upgrade to 0.6.35 or later; open-webui (PyPI): upgrade to 0.6.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64495 attacked?: It is attacked over the network.
Am I affected by CVE-2025-64495?: Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

open-webui (npm): upgrade to 0.6.35 or later
```
npm install open-webui@0.6.35
```
open-webui (PyPI): upgrade to 0.6.35 or later
```
pip install "open-webui>=0.6.35"
```

Technical details

This is a stored DOM XSS vulnerability in the RichTextInput.svelte component (line 348) where user-supplied prompt content is parsed with the marked.js library and then directly assigned to element.innerHTML without sanitization. While marked.parse() provides minimal escaping, it does not prevent XSS. The attack requires: (1) an attacker with USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS permission to create a prompt containing a malicious payload, and (2) a victim with the 'Insert Prompt as Rich Text' setting enabled to trigger the payload via a chat command. An attacker can bypass quote filtering by constructing JavaScript strings from decimal codepoints. The fix is to sanitize HTML output with DOMPurify before DOM assignment. A patch is available in version 0.6.35 and later.

Affected products

Open WebUI Open WebUI <= 0.6.34

Identifiers

CVE-2025-64495
GHSA-w7xj-8fx7-wfch
PYSEC-2026-1741

Timeline

2025-11-07: disclosed: Security advisory published on GitHub
2025-11-07: patched: Fix available in version 0.6.35

References

https://github.com/open-webui/open-webui/security/advisories/GHSA-w7xj-8fx7-wfch

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.