Attack Chain

1. A low-privileged attacker crafts a malicious Python payload using Pyodide's pyodide.http.pyfetch or the js module. The payload is designed to send an authenticated POST request to the /api/v1/functions/create endpoint.
2. The POST request body includes JSON data defining a new Function/Tool, whose content field contains arbitrary Python commands for server-side execution, such as import os; os.system('<attacker command>').
3. The attacker stores this malicious payload within an Open WebUI chat message.
4. The attacker shares this chat message with a victim, who possesses elevated privileges (e.g., administrator or workspace.functions/workspace.tools permissions).
5. The victim accesses the shared chat message containing the malicious Python payload.
6. The victim clicks the "Run" button associated with the payload, triggering its execution within the client-side Pyodide web worker.
7. The executed Pyodide payload leverages the victim's session cookie to send the crafted authenticated /api/v1/functions/create request to the Open WebUI server.
8. The server processes the request, creating a new Function/Tool with the attacker's arbitrary Python code, leading to immediate remote code execution on the Open WebUI server.

Impact

Successful exploitation of CVE-2026-59214 allows a low-privileged attacker to achieve remote code execution on the Open WebUI server. This impact is contingent on the victim being an administrator or a user holding workspace.functions or workspace.tools permissions. The attacker can then execute arbitrary system commands on the server, potentially leading to full system compromise, data exfiltration, or further lateral movement within the compromised environment. Even without RCE, the executed code can issue any authenticated request as the victim, enabling unauthorized actions or data access within the application.

Recommendation

• Apply the patch by upgrading Open WebUI to version 0.10.0 or later to address CVE-2026-59214, ensuring Pyodide runs in a sandboxed iframe.
• If immediate upgrade is not possible, disable Pyodide code execution or configure the Code Execution / Code Interpreter engine to use a server-side option as a workaround.
• Implement robust logging and monitoring for suspicious POST requests targeting the /api/v1/functions/create endpoint on your Open WebUI instance, specifically looking for content parameters within the request body that contain os.system or other indicators of arbitrary command execution.