Open WebUI versions 0.6.33 and below have a code injection vulnerability in the Direct Connections feature. This flaw allows malicious external model servers to execute arbitrary JavaScript in users' browsers via Server-Sent Event (SSE) 'execute' events. Exploitation can lead to theft of authentication tokens, full account takeover, and, when combined with another vulnerability in the Functions API, remote code execution on the backend server. The attack requires the victim to enable Direct Connections and add the attacker's malicious server URL, typically via social engineering. A fix is available in version 0.6.35.