Skip to content
COOEY

EXPOSURES › CVE-2026-59214

CVE-2026-59214

HIGH
DETAIL
SourceNVD · cve Published2026-07-09 CVSS7.3 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-59214 ↗
SHAME 25/100

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpReques

▸ RECOMMENDED ACTION  Patch the affected products and confirm your instances are covered.

PLAYERS IMPLICATED
openwebui · vendoropen webui · product
DESCRIPTION

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.