CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-04 · updated 2026-09-18
Weakness: CWE-79

Description

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The catch branch fell back to inserting the original math source into the page as HTML through {@html} rather than as text, so script in the message runs in the browser of whoever views it, including shared chats and channels. The viewer's session token in localStorage can be stolen, and an administrator viewer can have their account taken over. This issue is fixed in 0.11.0.

Affected products

open-webui: from 0.10.0 before 0.11.0 — fixed in 0.11.0

How to fix

Upgrade to a fixed version: open-webui 0.11.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-70492 or the next vulnerability affects your stack