Open WebUI Direct Connections SSE Code Injection
- Product
- Open WebUI Open WebUI
- CVE
- CVE-2025-64496
- Disclosed
- 2025-11-08
- CVSS
- 7.3
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- Open WebUI < 0.6.35 (with Direct Connections enabled)
- Fixed
- 0.6.35
Summary
Cato CTRL found that a malicious model server connected to Open WebUI could push events that ran JavaScript in the user's browser. The stolen session could then be used with Open WebUI's Functions feature to run Python on the backend.
Root cause
The frontend SSE handler for Direct Connections processed an 'execute' event type by passing its payload to new Function(), executing arbitrary JavaScript from the external model server in the Open WebUI origin. That script could read the JWT from localStorage; with the workspace.tools permission, the attacker could then create Functions/Tools whose Python runs unsandboxed on the server.
Impact
Account takeover and, for users with tools permission, remote code execution on the Open WebUI server.
Detection
Review which users enabled Direct Connections and which external model URLs are configured; audit newly created Functions/Tools. Version check < 0.6.35.
Mitigation
Upgrade to 0.6.35+, keep Direct Connections disabled unless needed, and limit workspace.tools permission.