https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 17:22:13 +0000 https://cve.radiocsirt.org/vuln/cve-2026-59214 <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.</p> <p><strong>Affected:</strong> open-webui</p> <p>Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools. This issue is fixed in version 0.10.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-59214 https://cve.radiocsirt.org/vuln/pysec-2026-3590 <p><strong>Affected:</strong> PyPI: open-webui</p> <p>**Title:** Same-origin Pyodide code execution allows server-side RCE via a shared chat</p> <p>### Summary</p> <p>Open WebUI runs client-side Python (Pyodide) in a same-origin web worker. Through Pyodide&#39;s JavaScript API (`pyodide.http.pyfetch`, or the `js` module which exposes the page&#39;s `fetch` / `XMLHttpRequest`) executed Python can issue requests on the application origin, and those requests carry the victim&#39;s session cookie. A low-privileged user can store such a payload in a chat message, share the chat, and when a victim opens it and clicks **Run** the payload executes authenticated same-origin requests as the victim. When the victim is an admin (or a user holding `workspace.functions` / `workspace.tools` permissions) the payload creates a Function/Tool whose body runs server-side, yielding **remote code execution**.</p> <p>### Details</p> <p>Pyodide&#39;s `js` bridge gives Python in the worker the same reach as inline JavaScript on the origin, and the worker is same-origin, so a credentialed request to the app&#39;s own API is authenticated as the victim. No separate XSS sink is required: storing the payload in a shared chat and having the victim run it is enough.</p> <p>```python from pyodide.http import pyfetch import json await pyfetch(&#39;/api/v1/functions/create&#39;, method=&#39;POST&#39;, credentials=&#39;include&#39;, headers={&#39;Content-Type&#39;: &#39;application/json&#39;}, body=json.dumps({&#39;id&#39;: &#39;x&#39;, &#39;name&#39;: &#39;x&#39;, &#39;meta&#39;: {&#39;description&#39;: &#39;x&#39;}, &#39;content&#39;: &#34;import os; os.sys…</p> <p><strong>Affected:</strong> PyPI: open-webui</p> <p>**Title:** Same-origin Pyodide code execution allows server-side RCE via a shared chat</p> <p>### Summary</p> <p>Open WebUI runs client-side Python (Pyodide) in a same-origin web worker. Through Pyodide&#39;s JavaScript API (`pyodide.http.pyfetch`, or the `js` module which exposes the page&#39;s `fetch` / `XMLHttpRequest`) executed Python can issue requests on the application origin, and those requests carry the victim&#39;s session cookie. A low-privileged user can store such a payload in a chat message, share the chat, and when a victim opens it and clicks **Run** the payload executes authenticated same-origin requests as the victim. When the victim is an admin (or a user holding `workspace.functions` / `workspace.tools` permissions) the payload creates a Function/Tool whose body runs server-side, yielding **remote code execution**.</p> <p>### Details</p> <p>Pyodide&#39;s `js` bridge gives Python in the worker the same reach as inline JavaScript on the origin, and the worker is same-origin, so a credentialed request to the app&#39;s own API is authenticated as the victim. No separate XSS sink is required: storing the payload in a shared chat and having the victim run it is enough.</p> <p>```python from pyodide.http import pyfetch import json await pyfetch(&#39;/api/v1/functions/create&#39;, method=&#39;POST&#39;, credentials=&#39;include&#39;, headers={&#39;Content-Type&#39;: &#39;application/json&#39;}, body=json.dumps({&#39;id&#39;: &#39;x&#39;, &#39;name&#39;: &#39;x&#39;, &#39;meta&#39;: {&#39;description&#39;: &#39;x&#39;}, &#39;content&#39;: &#34;import os; os.sys…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3590