Open CoreUI Desktop

by githubv0.9.6

Last updated Jul 27, 2026

Open CoreUI - A rewritten Open WebUI in Rust, significantly reducing memory and resource usage, requiring no dependency services, no Docker, with both a server version and a Tauri-based desktop client. (formerly Open WebUI Lite)

Visit homepage

Install with winget

$ winget install --id xxnuo.OpenCoreUI.Desktop --exact --version 0.9.6

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Silent install command for Open CoreUI Desktop

Open CoreUI Desktop uses EXE (NSIS). The silent install switches are /S.

One-line silent install (x64, user scope)

Open.CoreUI.Desktop_0.9.6_x64-setup.exe /S

See the full silent install reference for Open CoreUI Desktop →

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

About

Open CoreUI, a lightweight implementation of Open WebUI

Features

- A desktop client with a single executable download to get started

- Use original frontend

- No Docker, Python, PostgreSQL, Redis dependencies required

- Lower memory footprint compared to original version (much lower)

- Lower hardware requirements compared to original version

- Better performance with Rust backend server compared to original version

Installers · v0.9.6

Architecture	Type	Scope	Download
x64	EXE NSIS	user	Direct
x64	MSI WiX	machine	Direct
arm64	EXE NSIS	user	Direct
arm64	MSI WiX	machine	Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

25 known CVEs via NVD

high8.3Patched in wingetCVE-2026-56400affects before 0.3.14Jul 15, 2026
open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious c...
Vendor advisory
high7.3Patched in wingetCVE-2026-56398affects before 0.9.5Jul 15, 2026
Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be st...
Vendor advisory
high7.7Fix availableCVE-2026-59221affects v0.9.6Jul 9, 2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass...
Patch Vendor advisory
low3.1Fix in v0.10.0CVE-2026-59715affects before 0.10.0Jul 9, 2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True. The ydoc:awareness:update and ydoc:document:leave Socket.IO handlers accepted collaborative-document even...
Patch Vendor advisory
medium4.3Fix in v0.10.0CVE-2026-59227affects before 0.10.0Jul 9, 2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user image-generation permission, allowing a non...
Patch Vendor advisory
low3.1Fix in v0.10.0CVE-2026-59226affects before 0.10.0Jul 9, 2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners without rechecking that they were still active or still had features.automations, and check_model_access only enforced...
Patch Vendor advisory
medium5.4Fix in v0.10.0CVE-2026-59225affects before 0.10.0Jul 9, 2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/co...
Patch Vendor advisory
high8.0Fix in v0.10.0CVE-2026-59224affects before 0.10.0Jul 9, 2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to m...
Patch Vendor advisory

Showing 8 of 25. Source: NVD, updated 5h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr - automated patching is the only way to keep up.

Related apps

NetsGogithub
zsio.NetsGov0.1.8
Self-hosted tunneling and node management platform
migu-music-dlgithub
swim2sun.migu-music-dlv0.1.2
Download Migu Lossless Music
VS Code Config Helpergithub
Guyutongxue.Vscchv4.0.10
功能强大的 VS Code C++ 配置器
AstrBot Launchergithub
AstrBot.AstrBotLauncherv0.3.9
AstrBot GUI manager
O
Ollama (Portable)Ollama
Ollama.Ollama.Portablev0.20.2
Start building with open models.
Claude CodeAnthropic PBC
Anthropic.ClaudeCodev2.1.220
Unleash Claude’s raw power directly in your terminal. Search million-line codebases instantly. Turn hours-long workflows into a single command. Your tools. Your workflow. Your codebase, evolving at thought speed.

More from github or browse ai, chatbot, large-language-model.

Frequently asked questions

How do I install Open CoreUI Desktop on Windows?

Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id xxnuo.OpenCoreUI.Desktop --exact --version 0.9.6. winget downloads the installer from github and runs it. Requires Windows 10 (1809+) or Windows 11.

How do I install Open CoreUI Desktop silently for unattended deployment?

Add --silent and accept the agreements upfront: winget install --id xxnuo.OpenCoreUI.Desktop --exact 0.9.6 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.

What are the silent install switches for Open CoreUI Desktop?

Open CoreUI Desktop uses EXE (NSIS). Run the downloaded installer with: Open.CoreUI.Desktop_0.9.6_x64-setup.exe /S. The silent switches are /S.

How do I uninstall Open CoreUI Desktop via winget?

Run: winget uninstall --id xxnuo.OpenCoreUI.Desktop --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from Open CoreUI Desktop's Apps & Features entry.

Is Open CoreUI Desktop free?

Open CoreUI Desktop is distributed under Apache-2.0. Refer to the publisher (https://github.com/xxnuo/open-coreui) for the full license terms - Wingetly itself does not charge for installation.

Does Open CoreUI Desktop work on Windows 10?

Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls Open CoreUI Desktop directly from the publisher.

How do I keep Open CoreUI Desktop up to date?

Run winget upgrade --id xxnuo.OpenCoreUI.Desktop --exact, or winget upgrade --all to update everything winget tracks. We index 1 version of Open CoreUI Desktop from microsoft/winget-pkgs.