GitHub Exploit Metadata - Exploit Intel

PoC files

16 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Technical assessment

Three Python scripts that exploit CVE-2026-0765, an OS command injection in Open WebUI's install_frontmatter_requirements function, to achieve remote code execution as root via pip install with attacker-controlled URLs, VCS specifiers, and pip flag injection.

Backdoor review

No backdoor observed in reviewed code

The PoC for CVE-2026-0765 is a disclosed exploit against Open WebUI. All three vectors (HTTP sdist, git+http VCS, pip flag injection) target the stated vulnerability in install_frontmatter_requirements() to achieve RCE on the target server. The payloads write marker files to /tmp on the target to confirm exploitation. No concealed behavior, unrelated payloads, or data exfiltration to an undisclosed third party was observed. The binary file (evil-1.0.tar.gz) was not inspected, but its source code is present in the text files and matches the disclosed exploit behavior.

ClassificationExploit

Model confidence98%

AuthenticationRequired

Languagespython

Target softwareOpen WebUI

Attack typescommand_injectionremote_code_execution

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact consists of three Python scripts (poc.py, poc_vector2_git.py, poc_vector3_flaginjection.py) that actively exploit CVE-2026-0765 by building and serving malicious payloads, authenticating to the target, triggering the vulnerable pip install, and verifying remote code execution. The scripts are designed to exercise the vulnerability, not merely detect it.

poc/poc.py:1-17poc/poc.py:189-197poc/poc_vector2_git.py:1-17poc/poc_vector3_flaginjection.py:1-17

Requirements

Target Open WebUI instance reachable from hostpoc/poc.py:35
Host reachable from target container for pip to fetch payloadpoc/poc.py:36
Authenticated user with tool/function creation permissionsREADME.md:32

Observed behavior

Builds a malicious Python sdist tar.gz with a weaponized setup.py that writes marker files to /tmppoc/poc.py:110-152
Starts an HTTP server to host the malicious packagepoc/poc.py:176-182
Authenticates to Open WebUI via signup or signinpoc/poc.py:236-281
Creates a tool with crafted frontmatter containing a malicious pip requirements URLpoc/poc.py:286-320
Verifies RCE by reading marker files written by the malicious setup.py via docker execpoc/poc.py:341-394
Vector 2 creates a malicious git repository and serves it via a minimal git smart HTTP serverpoc/poc_vector2_git.py:119-178
Vector 3 hosts a fake PEP 503 PyPI index and injects --extra-index-url and --trusted-host pip flags via comma-separated requirementspoc/poc_vector3_flaginjection.py:161-236

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Marker File: /tmp/pwned_cve_2026_0765Written by the malicious setup.py on the target to confirm RCE.poc/poc.py:65
Marker File: /tmp/pwned_cve_2026_0765_gitWritten by the git+http vector payload on the target to confirm RCE.poc/poc_vector2_git.py:65
Marker File: /tmp/pwned_cve_2026_0765_flaginjectWritten by the flag injection vector payload on the target to confirm RCE.poc/poc_vector3_flaginjection.py:66
Target Url: http://{target_host}:{target_port}The target Open WebUI instance, configured by the operator via command-line arguments.poc/poc.py:422-425
Attacker Url: http://{attacker_host}:{attacker_port}The attacker-controlled server hosting the malicious payload, configured by the operator.poc/poc.py:422-425

Review boundaries

What the analysis did not establish

One binary file (poc/malicious_pkg/evil-1.0.tar.gz, 930 bytes) was flagged as binary and not analyzed; it is a pre-built malicious sdist package whose contents are partially reconstructed from the text scripts.
The evidence includes a verification report (poc_verification_report.md) claiming successful exploitation, but the analysis treats all supplied data as untrusted and does not confirm execution.
One binary file (poc/malicious_pkg/evil-1.0.tar.gz, 930 bytes) was not inspected. Its source code is present in the text files and matches the disclosed exploit behavior.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

CVE-2026-0765/docker-compose.yml

Created 2026-05-19Vuln labCVE-2026-0765Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2026-0765/docker-compose.yml

Analysisdeepseek-v4-pro:cloud · 2026-08-14

Environment assessment

A Docker Compose environment that runs a single vulnerable Open WebUI v0.6.32 instance, intended as a target for demonstrating CVE-2026-0765, a pip command injection vulnerability.

CVE-2026-0765/docker-compose.yml:1-41CVE-2026-0765/README.md:1-271

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'Lab Setup' for CVE-2026-0765, a 0-day OS command injection vulnerability in Open WebUI. The docker-compose.yml defines a single 'vulnerable' service built from a Dockerfile that uses a known vulnerable image (v0.6.32). Multiple PoC scripts are provided to exploit the target.

CVE-2026-0765/README.md:1-5CVE-2026-0765/README.md:67-78CVE-2026-0765/docker-compose.yml:1-5

Lab shapeCompose · mixed

Services1

Compose manifests1

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

vulnerable

vulnerable targetOpen WebUI application server

A containerized Open WebUI v0.6.32 instance, built from the official image ghcr.io/open-webui/open-webui:v0.6.32. It exposes port 8080 and is configured with authentication enabled and self-registration allowed. The service is the target for the CVE-2026-0765 exploit.

CVE-2026-0765/docker-compose.yml:8-36CVE-2026-0765/Dockerfile.vulnerable:1

PoC scripts (poc.py, poc_vector2_git.py, poc_vector3_flaginjection.py)

exploit deliveryverification

Three Python scripts that run from the host. Each script starts a local HTTP server to serve a malicious Python package, authenticates to the Open WebUI target, creates a tool with crafted frontmatter to trigger pip install, and verifies RCE by checking for a marker file written inside the container via docker exec.

CVE-2026-0765/poc/poc.py:1-432CVE-2026-0765/poc/poc_vector2_git.py:1-412CVE-2026-0765/poc/poc_vector3_flaginjection.py:1-379

Malicious package (evil-1.0)

exploit payload

A Python sdist package with a weaponized setup.py that writes marker files (/tmp/pwned_cve_2026_0765, /tmp/pwned_rce_confirmed) to prove code execution. It is built and served by the PoC scripts.

CVE-2026-0765/poc/malicious_pkg/evil-1.0/setup.py:1-44

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-0765

Supported by supplied evidence

The entire lab is structured around CVE-2026-0765. The README, PoC scripts, and verification report all describe and demonstrate the vulnerability. The docker-compose.yml and Dockerfile set up the vulnerable version (v0.6.32) cited in the advisory.

CVE-2026-0765/README.md:1-5CVE-2026-0765/README.md:67-78CVE-2026-0765/poc/poc.py:1-5

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker with Compose pluginCVE-2026-0765/README.md:67-68
Python 3 on the host (for running PoC scripts)CVE-2026-0765/README.md:67-68
Host must be reachable from the Docker container (for pip to fetch the malicious payload)CVE-2026-0765/README.md:107-108
The lab container must be running and healthy before running PoC scriptsCVE-2026-0765/README.md:72-78

Evidence-described exercise path

Start the lab environment using 'docker compose up -d' and wait for the vulnerable service to become healthy.CVE-2026-0765/README.md:72-78
Run one of the PoC scripts (e.g., 'python3 poc/poc.py 127.0.0.1 8080 host.docker.internal 9999') from the host. The script will start a local HTTP server, authenticate to the target, create a malicious tool, and verify RCE.CVE-2026-0765/README.md:110-115
Observe the output confirming RCE, including the contents of the marker file written inside the container.CVE-2026-0765/README.md:130-145
Optionally, manually verify the marker file using 'docker exec cve-2026-0765-vulnerable cat /tmp/pwned_cve_2026_0765'.CVE-2026-0765/README.md:160-162

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target container. The PoC scripts exploit the target, write marker files inside it, and verify RCE using 'docker exec' to read those files. This is expected exploit behavior for a vulnerability lab. There is no evidence of host compromise, external system targeting, credential theft, data destruction, or any action outside the documented exercise.

CVE-2026-0765/poc/poc.py:1-432CVE-2026-0765/poc/poc_vector2_git.py:1-412CVE-2026-0765/poc/poc_vector3_flaginjection.py:1-379

Review boundaries

What the analysis did not establish

The packet does not include the Dockerfile.vulnerable content beyond the single FROM line, but the topology confirms it references the official image.
The packet includes a file inventory entry for a binary file (evil-1.0.tar.gz) that was not inspected, but its source code (setup.py) is provided and inspected.
The README mentions a related CVE-2026-0766, but that CVE is not part of this unit's scope and is not assessed.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.