Open WebUI XSS Vulnerability (CVE-2025-64495) Enables Remote Code Execution via Malicious Prompts
A critical vulnerability, CVE-2025-64495, has been identified in Open WebUI, a self-hosted AI web interface framework. The flaw is a stored DOM-based cross-site scripting (XSS) issue in the "Insert Prompt as Rich Text" feature, which allows attackers to inject malicious scripts. If exploited, this vulnerability can lead to remote code execution (RCE) with administrative privileges when an admin interacts with a crafted prompt, posing a significant risk to organizations using Open WebUI for managing AI workflows and data.
Security researchers have published proof-of-concept (PoC) details and technical analysis demonstrating how the vulnerability can be leveraged to compromise the system. The issue highlights the importance of sanitizing user input in web applications, especially those handling sensitive AI operations. Administrators are urged to apply available patches and review their Open WebUI deployments to mitigate the risk of exploitation.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Researchers describe admin-to-RCE impact path for CVE-2025-64495
Follow-up reporting detailed how exploitation of CVE-2025-64495 could be chained from stored XSS to remote code execution by targeting an administrator. The write-up emphasized malicious prompts as the delivery mechanism and clarified the severity of the attack path.
Stored DOM XSS in Open WebUI documented as CVE-2025-64495
A vulnerability affecting Open WebUI was publicly disclosed as CVE-2025-64495, described as a stored DOM XSS issue tied to the "Insert Prompt as Rich Text" feature. The flaw could let a malicious prompt execute attacker-controlled script in an administrator's browser session.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical Vulnerabilities in Open WebUI Enable Remote Code Execution and Token Theft
Security researchers have identified a critical vulnerability in Open WebUI, a self-hosted enterprise interface for large language models (LLMs), that allows attacker-controlled model servers to inject malicious code into enterprise environments. The flaw, tracked as CVE-2025-64496, stems from insecure handling of Server-Sent Events (SSE) when connecting to external model endpoints via the "Direct Connections" feature. Exploiting this vulnerability, attackers can execute arbitrary JavaScript in the browser context, steal JSON Web Tokens (JWTs), and, in some cases, escalate privileges to achieve remote code execution (RCE) on backend servers, potentially compromising entire AI workloads and sensitive enterprise data. The vulnerability affects Open WebUI versions up to and including 0.6.34 and has been addressed in version 0.6.35. Attackers can leverage the flaw by convincing users to connect to a malicious model endpoint, often under the guise of a "free GPT-4 alternative." Once exploited, the attacker gains persistent access to the victim's AI workspace, documents, chats, and embedded API keys. Security experts strongly recommend that organizations using Open WebUI update to the latest version immediately to mitigate the risk of exploitation and prevent unauthorized access to their AI infrastructure.
Jun 29, 2026
OpenCode AI Coding Agent RCE via Unauthenticated Local Server and Web UI XSS
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026
Prompt-injection RCE risks in agentic AI tools with OS and browser automation
Security researchers and CERT/CC reporting highlighted **critical prompt-injection-to-execution paths** in agentic AI systems where untrusted content can be interpreted as instructions and then executed via connected tools. In *ModelScope MS-Agent*, **CVE-2026-2256** (CVSS 9.8) was reported as a **command injection / RCE** issue tied to the framework’s “Shell tool,” where external input is not properly sanitized before being passed to OS command execution; a `check_safe()` denylist-based filter was described as bypassable via obfuscation/alternate syntax, enabling arbitrary command execution and potential full host compromise. Separate research from **Zenity Labs** described a broader class of **agentic AI browser** weaknesses (including Perplexity’s *Comet*) where attackers can hijack autonomous workflows using indirect prompt injection delivered through normal channels such as a **calendar invite**; prior to patches, this could drive the browser to access local files, read directories/files, and exfiltrate data, and in some cases leverage the agent’s existing authenticated context to interact with sensitive services (including password managers). A similar execution-model risk was reported in *Langflow*’s CSV Agent as **CVE-2026-27966** (CVSS 10.0), where `allow_dangerous_code=True` was hardcoded, enabling LangChain’s `python_repl_ast` tool and allowing remote attackers with chat access to coerce **server-side code execution** and full system compromise via prompt injection.
Jun 29, 2026