CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error.
What it is
Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the browser of whoever views it. Every surface that renders messages is affected, including shared chats and channels, and the missing control is output escaping on the error path.
Preconditions Default configuration, no flags involved. The attacker needs a normal user account and a way to get the target to open the content: a shared chat link, a channel the target reads, or any other message surface. No admin rights and no non-default settings are required on either side.
Fix Fixed in 0.11.0 by commit bc600d3f0 (PR #26718). The error path now HTML-escapes the math source before it reaches the DOM, so a failed render displays the formula as text instead of as markup. Upgrading fully resolves th
How to check
- Affected: open-webui (pip) >= 0.10.0, < 0.11.0.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade open-webui to 0.11.0 or later.
pip show open-webui | grep Version