CVE-2025-46719
2 advisories.
PyPI/open-webui CVE-2025-46719: medium 5.4, EPSS 0.58%
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
Action: Upgrade open-webui to 0.6.6 or later.
pip install open-webui==0.6.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.6 | - |
Fixed versions
| 0.6.6 |
Sources
- osv: GHSA-9f4f-jv96-8766
- nvd: CVE-2025-46719
- https://github.com/open-webui/open-webui/security/advisories/GHSA-9f4f-jv96-8766
- https://github.com/open-webui/open-webui/commit/6fd082d55ffaf6eb226efdeebc7155e3693d2d01
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/main/src/lib/components/chat/Messages/Markdown/MarkdownTokens.svelte#L269-L279
- https://github.com/open-webui/open-webui/releases/tag/v0.6.6
CVE-2025-46719 · published · modified · JSON
PyPI/open-webui CVE-2025-46719: medium 5.4, EPSS 0.58%
Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via functions
Action: Upgrade open-webui to 0.6.6 or later.
pip install open-webui==0.6.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.6 | - |
Fixed versions
| 0.6.6 |
Sources
- osv: PYSEC-2026-2716
- nvd: CVE-2025-46719
- https://github.com/open-webui/open-webui/security/advisories/GHSA-9f4f-jv96-8766
- https://github.com/open-webui/open-webui/commit/6fd082d55ffaf6eb226efdeebc7155e3693d2d01
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/main/src/lib/components/chat/Messages/Markdown/MarkdownTokens.svelte#L269-L279
- https://github.com/open-webui/open-webui/releases/tag/v0.6.6
- https://pypi.org/project/open-webui
- https://github.com/advisories/GHSA-9f4f-jv96-8766
CVE-2025-46719 · published · modified · JSON