CVE-2025-64495: Open WebUI DOM XSS Vulnerability

CVE-2025-64495 Overview

CVE-2025-64495 is a DOM-based Cross-Site Scripting (XSS) vulnerability in Open WebUI, a self-hosted artificial intelligence platform. The flaw affects versions 0.6.34 and earlier when the Insert Prompt as Rich Text feature is enabled. The prompt body is written to the .innerHTML DOM sink without sanitization, allowing arbitrary HTML and JavaScript execution. Any authenticated user with prompt-creation permissions can plant a malicious payload. The payload executes in another user's browser session when that user runs the corresponding / command to insert the prompt. Open WebUI resolved the issue in version 0.6.35 [CWE-79].

Critical Impact
An authenticated low-privilege user can store JavaScript payloads that execute in victim browsers, enabling session token theft, account takeover, and unauthorized actions within the Open WebUI application.

Affected Products

Open WebUI versions 0.6.34 and below
Deployments with Insert Prompt as Rich Text enabled
Multi-user Open WebUI instances permitting prompt creation by non-admin users

Discovery Timeline

2025-11-08 - CVE-2025-64495 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-64495

Vulnerability Analysis

Open WebUI supports a / slash-command interface that inserts saved prompts directly into the chat window. When Insert Prompt as Rich Text is enabled, the client renders the stored prompt body as HTML rather than plain text. The rendering path in src/lib/components/common/RichTextInput.svelte assigns the prompt content to the .innerHTML property of a DOM node without sanitizing untrusted markup. The browser parses attacker-controlled <script>, event-handler, or javascript: payloads within the victim's authenticated session.

Exploitation requires that a victim voluntarily invoke the attacker-supplied prompt via slash-command, satisfying the user-interaction requirement. Because the payload runs inside the Open WebUI origin, it inherits access to session cookies, API tokens, chat history, and model configuration accessible to the target user.

Root Cause

The root cause is unsafe use of the .innerHTML sink in the Svelte RichTextInput component combined with the absence of HTML sanitization on prompt bodies rendered as rich text. Markdown output from marked was assigned to the DOM without passing through a sanitizer such as DOMPurify.

Attack Vector

The attack path is network-based and requires authenticated low-privilege access plus victim interaction. An attacker with the create prompt permission stores a prompt whose body contains an HTML payload with an inline JavaScript handler. Any other user who triggers the associated /command in a chat window executes the payload in their browser under the Open WebUI origin.

text

 <script lang="ts">
 	import { marked } from 'marked';
+	import DOMPurify from 'dompurify';
+
 	marked.use({
 		breaks: true,
 		gfm: true,

Source: GitHub commit eb9c4c0. The patch introduces DOMPurify to sanitize markdown-rendered HTML before it reaches the DOM sink.

Detection Methods for CVE-2025-64495

Indicators of Compromise

Prompt records containing <script>, onerror=, onload=, javascript:, or <iframe> fragments in the prompt body field
Outbound HTTP requests from user browsers to untrusted domains immediately after / prompt invocation
Unexpected API calls to /api/v1/auths/, /api/v1/users/, or model-configuration endpoints originating from active chat sessions

Detection Strategies

Audit the Open WebUI prompts table for HTML tags or event handler attributes in stored prompt content
Review application logs for prompt-creation events by non-admin accounts, then correlate with subsequent slash-command invocations by other users
Inspect browser Content Security Policy (CSP) violation reports for inline-script or event-handler blocks tied to the Open WebUI origin

Monitoring Recommendations

Alert on new or modified prompt records containing HTML tags, script markup, or unusual URI schemes
Monitor authentication and session endpoints for anomalous requests generated from chat pages
Track version metadata for Open WebUI deployments to confirm all instances run 0.6.35 or later

How to Mitigate CVE-2025-64495

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.6.35 or later, which introduces DOMPurify sanitization on rich-text prompt rendering
Review existing prompts and remove any entries containing HTML tags, inline event handlers, or script content
Restrict prompt-creation permissions to trusted administrators until the upgrade is verified in production

Patch Information

The fix is committed in open-webui commit eb9c4c0 and shipped in release 0.6.35. Details are published in the GHSA-w7xj-8fx7-wfch advisory. The patch imports DOMPurify and sanitizes markdown output before assignment to .innerHTML in RichTextInput.svelte.

Workarounds

Disable the Insert Prompt as Rich Text setting so prompt bodies render as plain text
Enforce a strict Content Security Policy that disallows inline scripts and untrusted event handlers on Open WebUI origins
Limit prompt-creation roles until patched, reducing the pool of accounts that can plant payloads

bash

# Upgrade Open WebUI container to the patched release
docker pull ghcr.io/open-webui/open-webui:0.6.35
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.6.35

# Verify running version
curl -s http://localhost:3000/api/version