CVE-2025-64496
📋 TL;DR
Open WebUI versions 0.6.224 and earlier contain a code injection vulnerability in the Direct Connections feature. Malicious external model servers can execute arbitrary JavaScript in victim browsers, leading to authentication token theft, account takeover, and potentially remote code execution when chained with the Functions API. This affects administrators and users who enable Direct Connections and add untrusted model URLs.
💻 Affected Systems
- Open WebUI
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Open WebUI instance leading to backend server remote code execution, data exfiltration, and persistent access.
Likely Case
Authentication token theft and account takeover of users who interact with malicious model servers.
If Mitigated
Limited impact if Direct Connections remains disabled and only trusted model servers are used.
🎯 Exploit Status
Requires social engineering to convince admin/users to add malicious model URL. Exploitation involves JavaScript injection via Server-Sent Events.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.35
Vendor Advisory: https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx
Restart Required: Yes
Instructions:
1. Backup your Open WebUI configuration and data. 2. Update to version 0.6.35 or later using your package manager or by pulling the latest Docker image. 3. Restart the Open WebUI service or container.
🔧 Temporary Workarounds
Disable Direct Connections
allKeep the Direct Connections feature disabled as it is by default.
Restrict Model URLs
allOnly add trusted, verified model server URLs to Direct Connections.
🧯 If You Can't Patch
- Disable Direct Connections feature entirely.
- Implement network segmentation to isolate Open WebUI from untrusted networks.
🔍 How to Verify
Check if Vulnerable:
Check if Open WebUI version is 0.6.224 or earlier and Direct Connections is enabled.Check Version:
Check the Open WebUI web interface settings or run 'docker inspect open-webui' for container version.Verify Fix Applied:
Confirm version is 0.6.35 or later and test Direct Connections functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution events in browser logs
- Unexpected Server-Sent Event connections to external domains
Network Indicators:
- Outbound connections to unknown model servers from Open WebUI instance
SIEM Query:
source="open-webui" AND (event="sse_execute" OR destination_ip NOT IN trusted_ips)