Open WebUI: Stored web worker XSS via Pyodide
Open WebUI
More for Open WebUI RSS feed for Open WebUI
- Severity
- Critical, CVSS 9.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-59214
- Affects
- Open WebUI
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 9, 2026
- Source last modified
- July 24, 2026
Description
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.
Description quoted from the NVD record.
Who is affected
Open WebUI is a self-hosted chat interface that lets people use AI models from a web browser. This flaw affects versions before 0.10.0. The problem is in the feature that runs Python code from a chat inside your browser. Someone can save harmful code in a chat. When another user clicks Run on it, that code can send requests to Open WebUI as that logged-in user. This can reach admin-only functions and run code on the server through the tools set up in Open WebUI. This flaw is rated Critical.
What to do
- If someone in your organization installed and runs Open WebUI, that person should check which version is in use. Any version before
0.10.0has this flaw. - Update Open WebUI to version
0.10.0or later as soon as possible. That version fixes this flaw. - If an IT provider or vendor runs Open WebUI for your organization, send them this advisory and ask when the update will be done.
- After updating, check that Open WebUI shows version
0.10.0or later.
Analysis written from the source record as of July 24, 2026 and reviewed before publishing.