Critical Vulnerabilities in Open WebUI Enable Remote Code Execution and Token Theft
Security researchers have identified a critical vulnerability in Open WebUI, a self-hosted enterprise interface for large language models (LLMs), that allows attacker-controlled model servers to inject malicious code into enterprise environments. The flaw, tracked as CVE-2025-64496, stems from insecure handling of Server-Sent Events (SSE) when connecting to external model endpoints via the "Direct Connections" feature. Exploiting this vulnerability, attackers can execute arbitrary JavaScript in the browser context, steal JSON Web Tokens (JWTs), and, in some cases, escalate privileges to achieve remote code execution (RCE) on backend servers, potentially compromising entire AI workloads and sensitive enterprise data.
The vulnerability affects Open WebUI versions up to and including 0.6.34 and has been addressed in version 0.6.35. Attackers can leverage the flaw by convincing users to connect to a malicious model endpoint, often under the guise of a "free GPT-4 alternative." Once exploited, the attacker gains persistent access to the victim's AI workspace, documents, chats, and embedded API keys. Security experts strongly recommend that organizations using Open WebUI update to the latest version immediately to mitigate the risk of exploitation and prevent unauthorized access to their AI infrastructure.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
Open WebUI fixes CVE-2025-64496 in version 0.6.35
The vulnerability was reported as affecting Open WebUI versions up to 0.6.34 and was fixed in version 0.6.35. Organizations were urged to patch immediately and apply mitigations such as short-lived rotating HttpOnly cookies and strict Content Security Policies.
Cato Networks discovers Open WebUI vulnerability CVE-2025-64496
Researchers at Cato Networks identified a critical flaw in Open WebUI's Direct Connections feature that lets attacker-controlled external model servers inject malicious code into enterprise AI backends. The issue can enable session token theft, account takeover, privilege escalation, and in some cases remote code execution on backend servers.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Open WebUI XSS Vulnerability (CVE-2025-64495) Enables Remote Code Execution via Malicious Prompts
A critical vulnerability, CVE-2025-64495, has been identified in Open WebUI, a self-hosted AI web interface framework. The flaw is a stored DOM-based cross-site scripting (XSS) issue in the "Insert Prompt as Rich Text" feature, which allows attackers to inject malicious scripts. If exploited, this vulnerability can lead to remote code execution (RCE) with administrative privileges when an admin interacts with a crafted prompt, posing a significant risk to organizations using Open WebUI for managing AI workflows and data. Security researchers have published proof-of-concept (PoC) details and technical analysis demonstrating how the vulnerability can be leveraged to compromise the system. The issue highlights the importance of sanitizing user input in web applications, especially those handling sensitive AI operations. Administrators are urged to apply available patches and review their Open WebUI deployments to mitigate the risk of exploitation.
Jul 1, 2026
OpenCode AI Coding Agent RCE via Unauthenticated Local Server and Web UI XSS
Security researchers disclosed two high-severity vulnerabilities in the open-source **OpenCode** AI coding agent that can allow **arbitrary command execution on a developer workstation** in drive-by scenarios. **CVE-2026-22812** stems from OpenCode automatically starting an **unauthenticated HTTP server** with **permissive CORS** (`Access-Control-Allow-Origin: *`), enabling any local process—or a malicious website via cross-origin requests—to invoke sensitive local API endpoints and execute shell commands with the user’s privileges. Separately, **CVE-2026-22813** is a **critical** issue in the OpenCode web UI where the markdown renderer can inject arbitrary HTML into the DOM without sanitization (no *DOMPurify* and no CSP), enabling JavaScript execution on the `http://localhost:4096` origin and subsequent access to local APIs that can spawn processes. Mitigations are available for both OpenCode issues: **CVE-2026-22812** is fixed in **OpenCode 1.0.216**, and **CVE-2026-22813** is fixed in **OpenCode 1.1.10**. Other items in the set describe unrelated vulnerabilities in different products (e.g., a command-injection flaw in an end-of-life VS Code extension, unsafe deserialization in *LlamaIndex*, ReDoS in *LangChain*, and various web app SQLi/XSS/access-control issues) and do not materially change the OpenCode risk picture; they should be tracked separately by affected-asset ownership and exposure.
Jun 29, 2026
Critical RCE in LLaMA-Factory WebUI via Malicious Model Path
A critical remote code execution vulnerability, tracked as **`CVE-2026-58116`**, affects **LLaMA-Factory** through version **0.9.5**. The flaw is in the WebUI **Chat** and **Training** interfaces, where user-supplied **Model path** input is passed to Hugging Face model-loading functions with **`trust_remote_code=True`**, allowing attacker-controlled code from a remote or local model repository to run with the privileges of the server process. Public reporting said the issue is remotely exploitable and carries a **CVSS 3.1 score of 9.8** and **CVSS 4.0 score of 9.3**. The vulnerability was publicly described as a model path injection issue that can be triggered by pointing the WebUI at a malicious Hugging Face repository containing crafted Python files executed during model loading. Reports said there is no UI option or configuration setting to disable the unsafe behavior in affected versions, expanding exposure across both interfaces. Recommended mitigations include updating LLaMA-Factory, sanitizing model path input, disabling **`trust_remote_code`** where possible, and restricting WebUI access to authorized users only.
Jun 30, 2026