CVE-2025-64496

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64496", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-11-05T19:12:25.103Z", "datePublished": "2025-11-08T01:29:02.654Z", "dateUpdated": "2025-11-13T21:37:59.663Z"}, "containers": {"cna": {"title": "Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events", "problemTypes": [{"descriptions": [{"cweId": "CWE-95", "lang": "en", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-829", "lang": "en", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-830", "lang": "en", "description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-501", "lang": "en", "description": "CWE-501: Trust Boundary Violation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx"}, {"name": "https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca"}], "affected": [{"vendor": "open-webui", "product": "open-webui", "versions": [{"version": "< 0.6.35", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-08T01:29:02.654Z"}, "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35."}], "source": {"advisory": "GHSA-cm35-v4vp-5xvx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T21:37:56.285429Z", "id": "CVE-2025-64496", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T21:37:59.663Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64496", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T21:37:56.285429Z"}}}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T21:37:49.829Z"}}], "cna": {"title": "Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events", "source": {"advisory": "GHSA-cm35-v4vp-5xvx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "open-webui", "product": "open-webui", "versions": [{"status": "affected", "version": "< 0.6.35"}]}], "references": [{"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx", "name": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca", "name": "https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-95", "description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-830", "description": "CWE-830: Inclusion of Web Functionality from an Untrusted Source"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-501", "description": "CWE-501: Trust Boundary Violation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-11-08T01:29:02.654Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64496", "state": "PUBLISHED", "dateUpdated": "2025-11-13T21:37:59.663Z", "dateReserved": "2025-11-05T19:12:25.103Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-11-08T01:29:02.654Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "open-webui", "vendor": "open-webui", "versions": [{"status": "affected", "version": "< 0.6.35"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8274E63-8712-4A92-9161-E5D5EC241CD4", "versionEndExcluding": "0.6.35", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35."}, {"lang": "es", "value": "Open WebUI es una plataforma de inteligencia artificial autoalojada dise\u00f1ada para operar completamente sin conexi\u00f3n. Las versiones 0.6.224 y anteriores contienen una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en la funci\u00f3n de Conexiones Directas que permite a servidores de modelos externos maliciosos ejecutar JavaScript arbitrario en los navegadores de las v\u00edctimas a trav\u00e9s de eventos de ejecuci\u00f3n de Server-Sent Event (SSE). Esto conduce al robo de tokens de autenticaci\u00f3n, a la toma de control completa de la cuenta y, cuando se encadena con la API de Funciones, permite la ejecuci\u00f3n remota de c\u00f3digo en el servidor backend. El ataque requiere que la v\u00edctima habilite las Conexiones Directas (deshabilitadas por defecto) y a\u00f1ada la URL del modelo malicioso del atacante, lo cual se puede lograr mediante ingenier\u00eda social del administrador y usuarios posteriores. Este problema est\u00e1 solucionado en la versi\u00f3n 0.6.35."}], "id": "CVE-2025-64496", "lastModified": "2026-06-17T09:54:27.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64496", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-13T21:37:56.285429Z", "version": "2.0.3"}}]}, "published": "2025-11-08T02:15:35.443", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/open-webui/open-webui/commit/8af6a4cf21b756a66cd58378a01c60f74c39b7ca"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-cm35-v4vp-5xvx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-95"}, {"lang": "en", "value": "CWE-501"}, {"lang": "en", "value": "CWE-829"}, {"lang": "en", "value": "CWE-830"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-11-10T09:33:27.956106+00:00", "updated": "2025-11-10T09:33:27.956133+00:00", "vendors": ["open-webui", "open-webui$PRODUCT$open-webui"]}