Open WebUI XSS Flaw (CVE-2025-64495) Risks Admin RCE via Malicious Prompts

Open WebUI has disclosed a high-severity vulnerability, CVE-2025-64495, affecting versions up to 0.6.34 and rated CVSS 8.7, which enables stored DOM-based XSS through the prompt-handling functionality when Insert Prompt as Rich Text is enabled.

According to the project maintainers, the vulnerability arises because the prompt body is assigned to the DOM sink .innerHTML without sanitisation, allowing any user with permission to create prompts to inject malicious HTML or JavaScript that executes when another user interacts with the compromised prompt. Researchers demonstrated a PoC in which a malicious prompt could trigger code via the chat interface, potentially exfiltrating session tokens or performing unauthorized actions in the victim’s browser context.

The advisory warns that the risk becomes catastrophic if an administrator account is affected, as admins can run arbitrary Python code on the server via the Functions feature, potentially enabling server-side function execution. Open WebUI has addressed the issue in version 0.6.35, introducing proper HTML sanitisation, and users are urged to upgrade and ensure Insert Prompt as Rich Text is disabled unless strictly required, with CSP and sandboxing recommended to reduce exposure.