CVE-2025-64496: PYSEC-2026-1729 - Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

CVE-2025-64496 · Severity: low · CVSS 3.1 · Published 2026-07-07

Open WebUI is a user interface for managing large language model interactions. The Direct Connections feature allows users to add external AI model servers; however, a code injection vulnerability allows malicious servers to execute arbitrary JavaScript code in users' browsers, leading to theft of authentication tokens and complete account takeover. When combined with the Functions API, attackers can achieve remote code execution on the backend server.

Technologies: open-webui (npm), open-webui (PyPI). Vendors: npm, PyPI.

Quick answers

Is CVE-2025-64496 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-64496 being exploited in the wild.
How severe is CVE-2025-64496?
Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
open-webui (npm) SEMVER:introduced=0,fixed=0.6.35; open-webui (PyPI) ECOSYSTEM:introduced=0,fixed=0.6.35.
Is there a fix for CVE-2025-64496?
Yes. open-webui (npm): upgrade to 0.6.35 or later; open-webui (PyPI): upgrade to 0.6.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64496 attacked?
It is attacked over the network.
Am I affected by CVE-2025-64496?
Check whether you run open-webui (npm) or open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • open-webui (npm): upgrade to 0.6.35 or later
    npm install open-webui@0.6.35
  • open-webui (PyPI): upgrade to 0.6.35 or later
    pip install "open-webui>=0.6.35"

Technical details

Open WebUI contains a code injection vulnerability in the frontend SSE (Server-Sent Events) handler that processes responses from external model servers added via the Direct Connections feature. The vulnerable code uses `new Function(event.data.code)` to execute arbitrary JavaScript when an SSE event with type 'execute' is received, with no validation of server trustworthiness, event type filtering, or sandboxing. An attacker can deploy a malicious OpenAI-compatible API server and social engineer victims into enabling Direct Connections and adding the attacker's URL; when the victim sends any message, the malicious server responds with SSE events containing arbitrary JavaScript. The injected code executes in the browser's full context with access to localStorage (containing unvalidated JWT tokens), cookies, and DOM, enabling token theft and account takeover. The vulnerability is fixed in version 0.6.35 and later.

Affected products

  • Open WebUI Open WebUI <= 0.6.34

Identifiers

  • CVE-2025-64496
  • GHSA-cm35-v4vp-5xvx
  • PYSEC-2026-1729

Timeline

  • 2025-11-07: disclosed
  • 2025-11-07: patched: Patched in version 0.6.35

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.