CVE-2026-70492: Open WebUI XSS Vulnerability

CVE-2026-70492 Overview

CVE-2026-70492 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Open WebUI, a self-hosted AI platform. The flaw affects versions from 0.10.0 up to (but not including) 0.11.0. The component src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte inserts raw message content via Svelte's {@html} directive when KaTeX rendering throws an unexpected error. An attacker crafts a math block that triggers a stack overflow rather than a parse error, bypassing throwOnError: false and executing arbitrary script in any viewer's browser.

Critical Impact
Attackers can steal session tokens from localStorage and take over administrator accounts through shared chats and channels.

Affected Products

Open WebUI versions 0.10.0 through 0.10.x
Open WebUI shared chats and channels feature
Self-hosted Open WebUI deployments rendering user-supplied math

Discovery Timeline

2026-08-04 - CVE-2026-70492 published to NVD
2026-08-05 - Last updated in NVD database
Fixed in - Open WebUI release v0.11.0

Technical Details for CVE-2026-70492

Vulnerability Analysis

Open WebUI renders math expressions in chat messages using KaTeX. The KatexRenderer.svelte component calls renderToString(content, { displayMode, throwOnError: false }) inside a try/catch block. The throwOnError: false option only suppresses KaTeX ParseError exceptions. Deeply nested math constructs cause KaTeX's recursive parser to throw a JavaScript RangeError from stack exhaustion, which escapes the option and lands in the catch branch.

The catch branch assigned the original untrusted content string to renderedHTML and inserted it via Svelte's {@html} directive. Any script tags or event-handler attributes embedded in the message execute in the viewer's browser context. Because messages persist on the server, this is a stored XSS affecting every user who loads the chat, shared link, or channel.

Root Cause

The root cause is an incomplete error-handling contract combined with unsafe HTML insertion. The developer assumed KaTeX only emits ParseError when throwOnError is false. Runtime errors such as RangeError from deep recursion bypass that contract. The fallback then treats attacker-controlled input as trusted HTML instead of escaping it.

Attack Vector

An authenticated user posts a chat message containing a math block engineered to exhaust the KaTeX parser stack. When any other user (including administrators) opens the chat, shared conversation, or channel, the malicious payload executes. The script reads the viewer's session token from localStorage and exfiltrates it, enabling account takeover.

text

 		try {
 			renderedHTML = renderToString(content, { displayMode, throwOnError: false });
 		} catch {
-			renderedHTML = content;
+			// throwOnError only suppresses ParseError; RangeError on deep nesting escapes, so escape the fallback (never {@html} raw source)
+			renderedHTML = content
+				.replaceAll('&', '&')
+				.replaceAll('<', '<')
+				.replaceAll('>', '>');
 		}
 	}
 </script>

Source: GitHub Commit bc600d3. The patch escapes &, <, and > in the fallback path so raw message content can no longer be interpreted as HTML.

Detection Methods for CVE-2026-70492

Indicators of Compromise

Chat messages containing unusually deep or malformed KaTeX math blocks with nested braces or subscripts designed to overflow the parser stack.
Outbound HTTP requests from user browsers to attacker-controlled domains carrying base64 or URL-encoded session tokens.
Administrator sessions used from IP addresses or user agents that differ from historical baselines shortly after viewing shared chats.

Detection Strategies

Inspect stored Open WebUI chat records for message bodies containing <script>, onerror=, or javascript: alongside $$ or \( math delimiters.
Deploy a Content Security Policy (CSP) with script-src 'self' and monitor report-uri endpoints for violations originating from chat views.
Correlate viewer sessions of shared chats with subsequent anomalous API calls made by the same user identity.

Monitoring Recommendations

Alert on Open WebUI instances still reporting a version between 0.10.0 and 0.10.x in banner or /api/version responses.
Log and review administrator authentication events following chat viewing activity to detect session reuse from new locations.
Monitor browser console error telemetry for RangeError events originating from KatexRenderer.svelte.

How to Mitigate CVE-2026-70492

Immediate Actions Required

Upgrade all Open WebUI instances to version 0.11.0 or later without delay.
Rotate administrator credentials and invalidate all active sessions after upgrade to defeat any tokens already exfiltrated.
Audit shared chats and channels for messages containing suspicious math blocks and remove them.

Patch Information

The fix is included in Open WebUI v0.11.0 and delivered through Pull Request #26718. The remediation escapes HTML metacharacters in the KaTeX render-error fallback so untrusted content is inserted as text, not markup. See the GitHub Security Advisory GHSA-pwxh-7358-jq2x for the vendor disclosure.

Workarounds

If immediate upgrade is not possible, restrict chat posting privileges to trusted users and disable public sharing of chats and channels.
Enforce a strict Content Security Policy that blocks inline scripts and external script sources to limit XSS payload execution.
Store session tokens in HttpOnly cookies rather than localStorage where the deployment configuration allows.

bash

# Upgrade Open WebUI to the patched release
docker pull ghcr.io/open-webui/open-webui:0.11.0
docker stop open-webui && docker rm open-webui
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  ghcr.io/open-webui/open-webui:0.11.0