Executive brief
Open WebUI is a user interface for interacting with large language models. A vulnerability allows a low-privileged user to send a malicious chat message that, if opened and run by an administrator, can grant the attacker full control over the server. This could lead to the theft of sensitive data, service disruption, or unauthorized access to the underlying infrastructure.
Technical details
Open WebUI versions prior to 0.10.0 execute client-side Python using Pyodide in a same-origin web worker. An attacker can craft a malicious Python payload and store it in a shared chat message. When a victim (specifically an administrator or user with workspace permissions) clicks 'Run', the Pyodide 'js' bridge allows the payload to issue authenticated same-origin API requests using the victim's session cookies. This can be used to create a new server-side 'Function' or 'Tool' containing arbitrary Python code, resulting in Remote Code Execution (RCE) on the host. The issue is patched in version 0.10.0 by moving Pyodide to a sandboxed iframe with an opaque origin.
Affected products
- Open WebUI open-webui < 0.10.0
Timeline
- 2026-06-29: disclosed
- 2026-07-09: advisory: NVD publication
- 2026-07-24: patched: GitHub Advisory published/updated