CVE-2026-59214 is a high severity flaw (CVSS 7.3) in Open WebUI before 0.10.0. Client-side Python runs in a same-origin web worker, so a shared chat can make authenticated requests as the viewer when they click Run. Admin victims risk server-side code execution. Upgrade to 0.10.0.
What's affected
- Open WebUI (pip package open-webui) before 0.10.0.
- Fixed version: 0.10.0 or later.
- The advisory says the worst case needs a victim who is an admin or holds workspace functions or tools permissions.
How to check if you're exposed
For a pip install run pip show open-webui. For Docker run docker image ls and check the image tag of the open-webui image. The version also appears in the application itself. Anything below 0.10.0 is affected.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade Open WebUI to 0.10.0 or later.
- Tell admins not to click Run on code in chats shared by others until you have upgraded.
- Reduce who holds admin and workspace tools or functions permissions.
- Review the Functions and Tools lists for entries nobody on your team created.
- Review who can share chats in your instance.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
The record classes this as CWE-79 (Cross-site Scripting). The advisory explains that Pyodide runs Python in the browser, and its JavaScript bridge gives that Python the same reach as script on the page. Because the worker is same-origin, requests it makes carry the victim's session cookie. No separate injection point is needed: a stored chat message plus a click on Run is enough.
What that request can do depends on the viewer. A low privilege user who shares a chat can act as an admin who runs it. The advisory says created Functions or Tools run Python on the server, which turns browser level access into server code execution.
The lesson applies to any AI front end that runs code from shared content: a sandbox that shares an origin with your app offers no isolation from it. The CISA KEV flag is false.
Open WebUI is popular as a self-hosted front end for local and hosted language models. Teams often run it on a shared server with several users, which is the situation where a low privilege user sharing content with an admin matters.
The worst outcome in the advisory needs an admin or a user with the workspace functions or tools permissions to run the shared code. That gives you a quick way to judge urgency: list who has those permissions, and the number is your exposure. Reducing it helps even after you upgrade.
The fixed version is 0.10.0, and the GitHub advisory lists the affected range as everything below it. If you track the project through a container image, pin the tag and update it deliberately rather than relying on a floating tag. If you installed from pip, pin the version in your requirements file so that rebuilds do not drift.
After the upgrade, review the Functions and Tools lists. Anything you do not recognize should be examined, because the advisory describes this as the way server code gets created.
Try it yourself
AI tooling packages move quickly. This demo shows how to get an alert when a package you run gets a new advisory.
Click through it at your own pace, or open it full screen.
Quick check
Is a click really required?
Yes. The advisory says the payload runs when the victim clicks Run on the shared code.
What about a related Open WebUI flaw?
CVE-2026-59216 is also fixed in 0.10.0, so one upgrade covers both.
Sources
Last reviewed: 19 October 2026.
