CVE-2025-64496: open-webui Eval Injection

Vulnerability summary

CVE-2025-64496 is a high (CVSS 8.0) Eval Injection vulnerability in open-webui. EPSS estimates a 7.23% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 08-11-2025
   PublishedVulnerability first disclosed.
2. 13-11-2025
   Last modifiedVulnerability information updated.

Description

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
• CWE-501Trust Boundary ViolationThe product mixes trusted and untrusted data in the same data structure or structured message.
• CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
• CWE-830Inclusion of Web Functionality from an Untrusted SourceThe product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.