CVE-2026-59214: Open WebUI Prior to 0.10.0 Stored Code Execution Vulnerability

Technical summary

Open WebUI executes client-side Python via Pyodide within a same-origin web worker prior to version 0.10.0. A malicious actor can inject JavaScript or Python code into chat payloads using pyodide.http.pyfetch or standard fetch/XMLHttpRequest APIs. Because the worker operates in the same origin and shares the victim's authenticated session, these payloads inherit the user's credentials. When triggered by user interaction (clicking Run), the code can invoke admin-only endpoints and execute arbitrary server-side code through the tool execution framework. The vulnerability is rooted in insufficient isolation between untrusted chat content and the authenticated execution context.

Business impact

Organizations deploying Open WebUI face credential abuse and unauthorized administrative actions initiated by low-privileged users. A bad actor—whether an insider or someone with chat-message-injection capability—can escalate privileges, access sensitive data, modify configurations, or deploy malicious tools across the platform. The requirement for user interaction (UI:R) means attackers must socially engineer victims to click 'Run', but stored payloads enable campaigns targeting multiple users asynchronously. Incidents could result in data exfiltration, service disruption, and loss of control over AI tool execution.

Affected systems

Open WebUI versions prior to 0.10.0 are affected. This includes all self-hosted deployments running 0.9.x and earlier releases. The vulnerability requires an authenticated user session (PR:L), so unauthenticated instances are not directly vulnerable, but multi-user Open WebUI instances are the primary risk vector. Verify your deployed version against the vendor advisory.

Exploitability

Exploitability is practical but not trivial. The attack requires three conditions: (1) network access to an Open WebUI instance, (2) an authenticated user account, and (3) the ability to store a malicious payload (via direct chat injection, API manipulation, or social engineering a user to paste code). Once stored, the payload persists and triggers silently when any user clicks 'Run'. No special tools or zero-day techniques are required—standard web APIs suffice. The CVSS 3.1 score of 7.3 (HIGH) reflects the high confidentiality and integrity impact tempered by the requirement for user interaction and login credentials.

Remediation

Upgrade Open WebUI to version 0.10.0 or later immediately. This release fixes the isolation issue by restructuring how client-side Python execution handles authentication and web APIs. Organizations unable to upgrade immediately should restrict chat functionality to trusted users only, disable the 'Run' button if the platform allows, audit chat message history for suspicious code patterns, and monitor tool execution logs for unauthorized administrative calls.

Patch guidance

Deploy Open WebUI 0.10.0 or newer. This version introduces proper sandboxing boundaries between chat payloads and authenticated session context. Before deploying, test in a staging environment to confirm compatibility with existing chat histories and tool configurations. There are no known breaking changes in 0.10.0, but review the release notes on the Open WebUI repository for any migration guidance. If you are running a managed or containerized instance, ensure your deployment pipeline pulls the updated image.

Detection guidance

Monitor for suspicious patterns in Open WebUI logs: (1) Tool execution calls originating from Run buttons on chat messages, especially calls to admin-only endpoints, (2) XMLHttpRequest or fetch requests to admin endpoints from client-side chat processing, (3) Unusual spike in tool invocations from low-privilege users, (4) Payloads in chat history containing pyodide.http, fetch, or XMLHttpRequest calls. Log aggregation and alerting on admin-endpoint access by non-admin session contexts will surface exploitation attempts. Inspect recent chat exports for embedded code.

Why prioritize this

Prioritize this vulnerability as HIGH urgency. The combination of stored attack surface, privilege escalation potential, and code execution through tools makes it a material risk for multi-user Open WebUI deployments. Although it requires user interaction, the persistence of stored payloads means attackers can target multiple users over time. Organizations with Open WebUI handling sensitive workloads or integrated with critical backend systems should patch immediately. Single-user or isolated instances present lower risk but should still be updated.

Risk score, explained

CVSS 3.1 score of 7.3 reflects HIGH severity: high confidentiality and integrity impact (user can access admin data and execute code), low attack complexity (standard web APIs), but requiring login (PR:L) and user interaction (UI:R). The same-origin constraint prevents cross-domain attacks, capping availability impact at none. The score accurately represents the threat: significant but not critical, and dependent on user session and behavioral trigger.

Frequently asked questions