Open WebUI Pyodide Sandbox Escape Leading to Same-Origin Privilege Escalation (CVE-2026-59214)
First seen Jul 11, 2026 · Updated Jul 11, 2026 · CVSS 7.3
Open WebUI versions prior to 0.10.0 execute client-side Python via Pyodide inside a same-origin web worker, which lacks proper isolation from the host page's authenticated session. A malicious stored chat payload can leverage pyodide.http.pyfetch or JS-exposed fetch/XMLHttpRequest APIs to make authenticated same-origin requests when a victim runs the code, enabling access to admin-only endpoints and server-side tool execution. This effectively turns a chat message into a stored XSRF/RCE primitive against self-hosted AI deployments.
Technical Analysis
The vulnerability stems from Open WebUI's design of running Pyodide-based Python execution in a same-origin web worker rather than a cross-origin sandboxed iframe, meaning code executed via the 'Run' button inherits the victim's authenticated session cookies and origin privileges. An attacker can craft a stored chat message containing Python code that calls pyodide.http.pyfetch or accesses the underlying JS fetch/XMLHttpRequest bindings to send authenticated requests to admin-only API endpoints, potentially modifying configuration, creating admin users, or invoking configured tools/integrations that execute server-side code. This is a stored cross-site request forgery style attack chained with sandbox escape, requiring only that a privileged user (e.g., admin) view and execute the malicious chat content. Because Open WebUI is widely deployed as a self-hosted front-end for LLM agent workflows, RAG pipelines, and tool-calling integrations, successful exploitation can lead to full compromise of the agent orchestration layer, exposure of connected API keys/credentials, and unauthorized invocation of downstream agent tools — representing a direct and significant risk to AI agent systems built on this platform.
Affected Systems
Open WebUI versions prior to 0.10.0 (all self-hosted deployments using the built-in Pyodide code execution/Run feature); instances with admin users who view or execute untrusted chat content; deployments with configured tools/integrations reachable via admin API endpoints
Indicators of Compromise
- No specific hashes, IPs, or domains published; indicators are behavioral — anomalous same-origin fetch/XMLHttpRequest calls originating from Pyodide worker execution, unexpected admin API calls (e.g., user creation, config changes) correlated with chat 'Run' actions, suspicious stored chat messages containing pyodide.http.pyfetch or fetch/XMLHttpRequest calls targeting /api/v1/admin or tool endpoints
Remediation Steps
- 1
Upgrade Open WebUI
Update all Open WebUI instances to version 0.10.0 or later, which fixes the sandbox isolation issue.
- 2
Restrict code execution feature
Until patched, disable or restrict the client-side Python/Pyodide 'Run' code execution feature, especially for non-admin or untrusted chat content.
- 3
Isolate admin sessions
Avoid using admin accounts to view or interact with untrusted or externally shared chats; use least-privilege accounts for routine chat review.
- 4
Audit admin API access logs
Review logs for unexpected admin endpoint calls, new user creation, or configuration changes coinciding with chat execution events.
- 5
Rotate credentials and API keys
Rotate any API keys, tool credentials, or admin secrets accessible via Open WebUI's configured tools, given potential exposure through server-side code execution.
- 6
Enforce sandbox hardening
Where custom deployments allow, enforce cross-origin iframe isolation or Content Security Policy restrictions for the Pyodide execution context to prevent same-origin credential reuse.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.