CVE-2026-59220

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.2 through 0.9.x

Description An issue exists in the SKILL MENTION RE and strip re regular expressions within the backend/open webui/utils/middleware.py file. These expressions parse skill mentions in the format <$skillId|label> using overlapping quantifiers. An authenticated user can send a chat message containing the sequence <$ without a closing > character to trigger quadratic backtracking, which blocks the asyncio event loop. Quadratic backtracking is a condition where a regular expression engine takes an exponential amount of time to process a string due to inefficient pattern matching.

Recommendations Update to version 0.10.0.