Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0765
Description
Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0765
Published:
2026-01-23
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No data.
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Open-webui | Open-webui | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Remediation
No vendor fix or workaround currently provided.
OpenCVE Recommended Actions
- Upgrade Open WebUI to the latest available version that incorporates the fix for the install_frontmatter_requirements command injection flaw.
- Restrict or disable the install_frontmatter_requirements functionality so that only privileged administrative users can invoke it; if it is not essential for normal operation, remove or block the endpoint entirely.
- Validate and sanitize all user-supplied input before it is passed to system calls, ensuring that shell meta‑characters cannot be injected.
Generated by OpenCVE AI on June 18, 2026 at 05:38 UTC.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
No reference.
History
Wed, 02 Sep 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-78 | |
| CPEs | ||
| Vendors & Products |
Openwebui
Openwebui open Webui |
|
| References |
|
|
| Metrics |
cvssV3_0
|
Wed, 02 Sep 2026 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0765 | Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0765 |
Wed, 02 Sep 2026 17:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the install_frontmatter_requirements function.The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28258. | Open WebU's investigation further investigation showed that this is intended functionality of the Plugins extension system, in which users granted the relevant permission author Python that the server executes by design, and not a security issue. https://docs.openwebui.com/security/vendor-dispositions/cve-2026-0765 |
Fri, 30 Jan 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Openwebui
Openwebui open Webui |
|
| CPEs | cpe:2.3:a:openwebui:open_webui:0.6.32:*:*:*:*:*:*:* | |
| Vendors & Products |
Openwebui
Openwebui open Webui |
Fri, 23 Jan 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 23 Jan 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Open-webui
Open-webui open-webui |
|
| Vendors & Products |
Open-webui
Open-webui open-webui |
Fri, 23 Jan 2026 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability. The specific flaw exists within the install_frontmatter_requirements function.The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28258. | |
| Title | Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability | |
| Weaknesses | CWE-78 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: REJECTED
Assigner: zdi
Published:
Updated: 2026-09-02T17:41:46.559Z
Reserved: 2026-01-08T22:50:03.282Z
Link: CVE-2026-0765
Vulnrichment
Updated: 2026-01-23T16:34:44.344Z
NVD
Status : Rejected
Published: 2026-01-23T04:16:03.390
Modified: 2026-09-02T18:18:14.040
Link: CVE-2026-0765
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-06-18T05:45:02Z
Weaknesses
No weakness.