CVE-2025-64495

Published Nov 8, 2025

Last updated 19 hours ago

Open WebUI

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-64495 affects Open WebUI, a self-hosted AI platform, specifically versions 0.6.34 and below. The vulnerability is a Stored DOM-based Cross-Site Scripting (XSS) issue that occurs when the "Insert Prompt as Rich Text" feature is enabled. The application doesn't sanitize the prompt body when inserting custom prompts into the chat window, which allows the injection of malicious code. An attacker with permission to create prompts can inject a malicious JavaScript payload that could be triggered when other users run the corresponding command to insert the prompt. Successful exploitation could lead to account takeover or even remote code execution. Version 0.6.35 addresses this vulnerability.

Description: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prompt body is assigned to the DOM sink .innerHtml without sanitisation. Any user with permissions to create prompts can abuse this to plant a payload that could be triggered by other users if they run the corresponding / command to insert the prompt. This issue is fixed in version 0.6.35.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.7
Impact score: 5.8
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-79

Hype score: Not currently trending

References