{"schemaVersion":3,"id":"CVE-2025-64496","aliases":["GHSA-cm35-v4vp-5xvx","PYSEC-2026-1729"],"status":"published","duplicateOf":null,"title":null,"description":"Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.","dates":{"published":"2025-11-08T01:29:02.654Z","modified":"2025-11-13T21:37:59.663Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Pypi","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","exploitability":5.4,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.3,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","exploitability":5.4,"impact":8.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.07228,"percentile":0.94303,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":-0.5420000000000008,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.0777},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.07228,"percentile":0.94303}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0777,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.07228,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.07228,"percentile":0.94303}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_OPEN-WEBUI_OPEN-WEBUI","name":"Open Webui","source":"github","url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-8gh5-qqh8-hq3x","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. \"eval\").","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/95.html"},{"id":"CWE-501","name":"Trust Boundary Violation","description":"The product mixes trusted and untrusted data in the same data structure or structured message.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/501.html"},{"id":"CWE-829","name":"Inclusion of Functionality from Untrusted Control Sphere","description":"The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/829.html"},{"id":"CWE-830","name":"Inclusion of Web Functionality from an Untrusted Source","description":"The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/830.html"}],"affected":[{"vendor":"Npm","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/open-webui","purlType":"npm","versions":[{"text":"< 0.6.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.35","eol":null,"hubHref":null},{"vendor":"open-webui","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.6.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.35","eol":null,"hubHref":"/vendor/open-webui/open-webui"},{"vendor":"openwebui","product":"open_webui","name":"open webui","label":"open_webui","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.6.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.35","eol":null,"hubHref":"/vendor/openwebui/open_webui"},{"vendor":"PyPI","product":"open-webui","name":"open-webui","label":"open-webui","ecosystem":"PyPI","cpePart":null,"purl":"pkg:pypi/open-webui","purlType":"pypi","versions":[{"text":"< 0.6.35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.35","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx","label":"github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx","hostname":"github.com","tags":["X Refsource CONFIRM","WEB","Exploit","Third Party Advisory"]},{"url":"https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca","label":"github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca","hostname":"github.com","tags":["X Refsource MISC","WEB","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64496","label":"nvd.nist.gov/vuln/detail/CVE-2025-64496","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/open-webui/open-webui","label":"github.com/open-webui/open-webui","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://pypi.org/project/open-webui","label":"pypi.org/project/open-webui","hostname":"pypi.org","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-cm35-v4vp-5xvx","label":"github.com/advisories/GHSA-cm35-v4vp-5xvx","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-11-08T01:29:02.654Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-11-13T21:37:59.663Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":43,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T21:19:46.644Z","stale":false,"partial":false}}