Skip to content
Fencer Vulns
high 7.3

CVE-2025-64496 json

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

published 2025-11-07 12 mo ago modified 2026-07-07 4 mo ago also EUVD-2025-38253 , GHSA-cm35-v4vp-5xvx , PYSEC-2026-1729

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
7.2%
EPSS 7.2% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

Patch / fix

  • npm open-webui 0.6.35
  • pypi open-webui 0.6.35
  • openwebui open_webui 0.6.35

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
11 mo ago

Exploit prediction

7.23% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
GitHub 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm open-webui
<0.6.35
0.6.35
pypi open-webui
<0.6.35
0.6.35

Affected products

  • open-webui open-webui

Classification

Weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere
  • CWE-830 Inclusion of Web Functionality from an Untrusted Source
  • CWE-501 Trust Boundary Violation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.