Open WebUI versions earlier than 0.10.0 executed client‑side Python with Pyodide inside a same‑origin web worker. Malicious stored chat content can invoke pyodide.http.pyfetch, fetch, or XMLHttpRequest, which when the user presses Run, sends authenticated requests from the browser to the server’s admin‑only endpoints. This flow can trigger server‑side code execution through configured tools, making the vulnerability a stored cross‑site scripting flaw (CWE‑79).

All Open Web deployments using a release earlier than 0.10.0 are affected. The flaw resides in the open‑webui:open‑webui product and is fixed in 0.10.0 and later.

The CVSS score of 7.3 reflects a high severity, while an EPSS score below 1% indicates a low but non‑zero likelihood of exploitation. Because the attack requires a carefully crafted stored payload that a victim later executes by clicking Run, the vector is a browser‑based interaction that can issue authenticated same‑origin requests. The vulnerability is not listed in the CISA KEV catalog and no public exploits have been reported at present, but the potential for privileged server‑side code execution warrants prompt remediation.