CVE-2025-64495
3 advisories.
npm/open-webui CVE-2025-64495: high 8.7, EPSS 0.49%
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Action: Upgrade open-webui to 0.6.35 or later.
npm i open-webui@0.6.35Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.35 | - |
Fixed versions
| 0.6.35 |
Sources
- osv: GHSA-w7xj-8fx7-wfch
- https://github.com/open-webui/open-webui/security/advisories/GHSA-w7xj-8fx7-wfch
- https://nvd.nist.gov/vuln/detail/CVE-2025-64495
- https://github.com/open-webui/open-webui/commit/eb9c4c0e358c274aea35f21c2856c0a20051e5f1
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/src/lib/components/common/RichTextInput.svelte#L348
CVE-2025-64495 · published · modified · JSON
PyPI/open-webui CVE-2025-64495: high 8.7, EPSS 0.49%
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Action: Upgrade open-webui to 0.6.35 or later.
pip install open-webui==0.6.35Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.35 | - |
Fixed versions
| 0.6.35 |
Sources
- osv: GHSA-w7xj-8fx7-wfch#PyPI/open-webui
- https://github.com/open-webui/open-webui/security/advisories/GHSA-w7xj-8fx7-wfch
- https://nvd.nist.gov/vuln/detail/CVE-2025-64495
- https://github.com/open-webui/open-webui/commit/eb9c4c0e358c274aea35f21c2856c0a20051e5f1
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/src/lib/components/common/RichTextInput.svelte#L348
CVE-2025-64495 · published · modified · JSON
PyPI/open-webui CVE-2025-64495: high 8.7, EPSS 0.49%
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Action: Upgrade open-webui to 0.6.35 or later.
pip install open-webui==0.6.35Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.6.35 | - |
Fixed versions
| 0.6.35 |
Sources
- osv: PYSEC-2026-1741
- https://github.com/open-webui/open-webui/security/advisories/GHSA-w7xj-8fx7-wfch
- https://nvd.nist.gov/vuln/detail/CVE-2025-64495
- https://github.com/open-webui/open-webui/commit/eb9c4c0e358c274aea35f21c2856c0a20051e5f1
- https://github.com/open-webui/open-webui
- https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/src/lib/components/common/RichTextInput.svelte#L348
- https://pypi.org/project/open-webui
- https://github.com/advisories/GHSA-w7xj-8fx7-wfch
CVE-2025-64495 · published · modified · JSON