AI Threat Alert
Open WebUI's client-side Python sandbox (Pyodide, running in a same-origin web worker) can be abused by code embedded in a stored chat: when a logged-in user clicks "Run," that code can use pyodide.http.pyfetch or the exposed JS fetch/XMLHttpRequest APIs to issue authenticated same-origin requests, reaching admin-only endpoints and triggering server-side code execution through whatever tools the instance has configured. This is a straightforward stored-payload-to-privilege-escalation chain that only requires social engineering a single click (UI:R, PR:L), scoring 7.3 high with full confidentiality and integrity impact. There is no public exploit or Nuclei template yet, EPSS is low in absolute terms (0.00246) despite ranking in the top 84th percentile for likely exploitation, and the CVE isn't in CISA's KEV catalog — so this reads as patch-now-not-panic rather than an active-exploitation emergency. Given Open WebUI's large footprint of 130 other CVEs tracked in this dataset, any self-hosted deployment that lets multiple users share chats or exposes admin-privileged accounts to shared conversations should upgrade to 0.10.0 before continuing to allow code execution features for lower-trust users. Until patched, restrict who can run shared code blocks and monitor admin API logs for anomalous same-origin requests originating from chat sessions.
What is the risk?
Network-exploitable with low attack complexity and only low privileges required, but it does require user interaction — a victim (ideally an admin or elevated user) must open a malicious shared chat and click "Run." That interaction requirement caps automatic mass exploitation but doesn't blunt targeted attacks against admins, since social engineering a single click inside a trusted internal tool is low-effort. Impact is high on confidentiality and integrity (admin-endpoint access, server-side code execution via configured tools) with no availability impact. No public exploit code, no Nuclei template, and no CISA KEV listing lower the near-term mass-exploitation risk, but the underlying primitive — sandbox escape to authenticated request forgery to agent-tool code execution — is a class of bug that's straightforward to weaponize once researchers or attackers focus on it, so risk should be treated as high despite the currently quiet exploitation signal.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Open WebUI | pip | < 0.10.0 | 0.10.0 |
Do you use Open WebUI? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade to Open WebUI 0.10.0 or later — this is the only complete fix. Until upgraded, disable or restrict the Python code interpreter (Pyodide execution) for chats that can be shared with or viewed by other users, and avoid granting admin roles to accounts that regularly open shared/imported conversations. Apply least-privilege scoping to any configured tools (limit which tools can reach sensitive server-side actions) so a sandbox escape can't cascade into full RCE. Detection: monitor admin API access logs for authenticated requests to admin-only endpoints originating unexpectedly from browser sessions shortly after a chat was opened or a "Run" action occurred, and flag any use of pyodide.http.pyfetch, fetch, or XMLHttpRequest inside shared/imported chat code blocks before execution.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-59214?
Open WebUI's client-side Python sandbox (Pyodide, running in a same-origin web worker) can be abused by code embedded in a stored chat: when a logged-in user clicks "Run," that code can use pyodide.http.pyfetch or the exposed JS fetch/XMLHttpRequest APIs to issue authenticated same-origin requests, reaching admin-only endpoints and triggering server-side code execution through whatever tools the instance has configured. This is a straightforward stored-payload-to-privilege-escalation chain that only requires social engineering a single click (UI:R, PR:L), scoring 7.3 high with full confidentiality and integrity impact. There is no public exploit or Nuclei template yet, EPSS is low in absolute terms (0.00246) despite ranking in the top 84th percentile for likely exploitation, and the CVE isn't in CISA's KEV catalog — so this reads as patch-now-not-panic rather than an active-exploitation emergency. Given Open WebUI's large footprint of 130 other CVEs tracked in this dataset, any self-hosted deployment that lets multiple users share chats or exposes admin-privileged accounts to shared conversations should upgrade to 0.10.0 before continuing to allow code execution features for lower-trust users. Until patched, restrict who can run shared code blocks and monitor admin API logs for anomalous same-origin requests originating from chat sessions.
Is CVE-2026-59214 actively exploited?
No confirmed active exploitation of CVE-2026-59214 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-59214?
Upgrade to Open WebUI 0.10.0 or later — this is the only complete fix. Until upgraded, disable or restrict the Python code interpreter (Pyodide execution) for chats that can be shared with or viewed by other users, and avoid granting admin roles to accounts that regularly open shared/imported conversations. Apply least-privilege scoping to any configured tools (limit which tools can reach sensitive server-side actions) so a sandbox escape can't cascade into full RCE. Detection: monitor admin API access logs for authenticated requests to admin-only endpoints originating unexpectedly from browser sessions shortly after a chat was opened or a "Run" action occurred, and flag any use of pyodide.http.pyfetch, fetch, or XMLHttpRequest inside shared/imported chat code blocks before execution.
What systems are affected by CVE-2026-59214?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, self-hosted LLM chat platforms, plugin/tool integrations.
What is the CVSS score for CVE-2026-59214?
CVE-2026-59214 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.29%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011 User Execution AML.T0050 Command and Scripting Interpreter AML.T0053 AI Agent Tool Invocation Compliance Controls Affected
What are the technical details?
Original Advisory
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.
Exploitation Scenario
An attacker crafts a chat containing a Python code block that, when executed in the Pyodide worker, calls pyodide.http.pyfetch (or the exposed JS fetch/XMLHttpRequest) against Open WebUI's admin API — for example to create a new admin user, extract API keys, or invoke a configured tool that can execute shell commands or write files server-side. The attacker shares this chat (via a shared link, exported conversation, or community model prompt) with a target who has an admin or privileged session. The victim opens the chat, believing the code is a benign demo or analysis script, and clicks "Run." The Pyodide worker executes the embedded requests using the victim's authenticated session, silently performing the admin action or triggering tool-based code execution — giving the attacker persistence or full instance compromise without ever obtaining direct credentials.
Weaknesses (CWE)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Primary
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-44551 9.1 open-webui: LDAP auth bypass — full account takeover
Same package: open-webui CVE-2026-45672 8.8 open-webui: code exec gate bypass via API endpoint
Same package: open-webui CVE-2026-44552 8.7 open-webui: Redis cache poisoning enables cross-instance tool hijack
Same package: open-webui CVE-2025-64495 8.7 Open WebUI: XSS-to-RCE via malicious prompt injection
Same package: open-webui CVE-2026-45315 8.7 open-webui: stored XSS → JWT theft and admin takeover
Same package: open-webui