CVE-2025-64496
Published: 08 November 2025
Summary
CVE-2025-64496 is a high-severity Eval Injection (CWE-95) vulnerability in Openwebui Open Webui. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 30.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the LLM/Generative AI Risks risk domain.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-38253
Vulnerability details
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers…
more
via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: artificial intelligence, open webui
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables client-side JavaScript execution via SSE code injection after social-engineered addition of malicious model URL (T1566.002, T1203), facilitating authentication token theft from browser localStorage (T1555.003).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Defining acceptable mobile code technologies and authorizing their use prevents inclusion of functionality from untrusted control spheres.
External identification of malicious code makes inclusion of functionality from untrusted network sources substantially harder to perform undetected.
Establishes and maintains trust boundaries with external organizations before allowing their systems to interact with organization resources.
Prevents information from crossing trust boundaries without explicit approved authorizations.
Defining interfaces, controls, and trust responsibilities in agreements helps prevent violations of trust boundaries during data exchanges.
Authorizing and reviewing connections helps maintain proper trust boundaries between internal components.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.