Open WebUI Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in Open WebUI. This issue arises in the load_tool_module_by_id function, where user-supplied strings are not properly validated before being used to execute Python code. As a result, authenticated attackers can exploit this vulnerability to execute arbitrary code in the context of the service account.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running under the service account's privileges.

Remediation

No specific patch is available. It is recommended to restrict interaction with the product.