[PR #22977] [CLOSED] fix(code-interpreter): inject Pyodide prompt into system message not user turn #26957

New Issue

GiteaMirror · 2026-04-20T06:47:19-05:00

GiteaMirror commented

2026-04-20 06:47:19 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/22977
Author: @BillionClaw
Created: 3/24/2026
Status: ❌ Closed

Base: main ← Head: clawoss/fix/22965-pyodide-system-prompt-v2

📝 Commits (1)

90807a6 fix(code-interpreter): inject Pyodide prompt into system message not user turn

📊 Changes

1 file changed (+4 additions, -2 deletions)

View changed files

📝 backend/open_webui/utils/middleware.py (+4 -2)

📄 Description

The code interpreter prompt (Pyodide) was injected into the user turn via add_or_update_user_message, creating a prompt injection vulnerability where a user could override the code interpreter instructions.

Changed add_or_update_user_message to add_or_update_system_message so the code interpreter prompt is injected as a system message where it cannot be tampered with by the user.

Fixes #22965

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/22977 **Author:** [@BillionClaw](https://github.com/BillionClaw) **Created:** 3/24/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `clawoss/fix/22965-pyodide-system-prompt-v2` --- ### 📝 Commits (1) - [`90807a6`](https://github.com/open-webui/open-webui/commit/90807a63c40ff9fc4c16784968a2fbb17e7b9ef4) fix(code-interpreter): inject Pyodide prompt into system message not user turn ### 📊 Changes **1 file changed** (+4 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/utils/middleware.py` (+4 -2) </details> ### 📄 Description The code interpreter prompt (Pyodide) was injected into the user turn via add_or_update_user_message, creating a prompt injection vulnerability where a user could override the code interpreter instructions. Changed add_or_update_user_message to add_or_update_system_message so the code interpreter prompt is injected as a system message where it cannot be tampered with by the user. Fixes #22965 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-20 06:47:19 -05:00

GiteaMirror closed this issue

2026-04-20 06:47:19 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#26957