Executive brief
Open WebUI is a user interface for managing large language model interactions. The Direct Connections feature allows users to add external AI model servers; however, a code injection vulnerability allows malicious servers to execute arbitrary JavaScript code in users' browsers, leading to theft of authentication tokens and complete account takeover. When combined with the Functions API, attackers can achieve remote code execution on the backend server.
Technical details
Open WebUI contains a code injection vulnerability in the frontend SSE (Server-Sent Events) handler that processes responses from external model servers added via the Direct Connections feature. The vulnerable code uses `new Function(event.data.code)` to execute arbitrary JavaScript when an SSE event with type 'execute' is received, with no validation of server trustworthiness, event type filtering, or sandboxing. An attacker can deploy a malicious OpenAI-compatible API server and social engineer victims into enabling Direct Connections and adding the attacker's URL; when the victim sends any message, the malicious server responds with SSE events containing arbitrary JavaScript. The injected code executes in the browser's full context with access to localStorage (containing unvalidated JWT tokens), cookies, and DOM, enabling token theft and account takeover. The vulnerability is fixed in version 0.6.35 and later.
Affected products
- Open WebUI Open WebUI <= 0.6.34
Timeline
- 2025-11-07: disclosed
- 2025-11-07: patched: Patched in version 0.6.35