CVE-2025-64495: Open WebUI vulnerable to Stored DOM XSS via prompts

# CVE-2025-64495: Open WebUI vulnerable to Stored DOM XSS via prompts

https://gcdradar.vercel.app/incidents/cve-2025-64495-open-webui-vulnerable-to-stored-dom-xss-via-p · AIR-2025-0369 · closed 2025-11-07

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-11-07
- AI role: Attack on AI
- Products: Open WebUI
- CVE ids: CVE-2025-64495
- CVSS: 8.7

## Summary

Open WebUI is vulnerable to DOM XSS when rich text prompts are enabled because prompt bodies lack sanitization. Users executing specific commands can trigger payloads leading to account takeover.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-11-08: CVE-2025-64495: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. (https://nvd.nist.gov/vuln/detail/CVE-2025-64495)
- 2025-11-07: CVE-2025-64495: Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE (https://github.com/advisories/GHSA-w7xj-8fx7-wfch)

## Sources

- 2025-11-07 GitHub Advisory Database: CVE-2025-64495: Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE https://github.com/advisories/GHSA-w7xj-8fx7-wfch
- 2025-11-08 NVD: CVE-2025-64495: Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. https://nvd.nist.gov/vuln/detail/CVE-2025-64495

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.