CVE-2026-70492 in Open WebUI
Summary
by MITRE • 08/05/2026
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The catch branch fell back to inserting the original math source into the page as HTML through {@html} rather than as text, so script in the message runs in the browser of whoever views it, including shared chats and channels. The viewer's session token in localStorage can be stolen, and an administrator viewer can have their account taken over. This issue is fixed in 0.11.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability exists within the Open WebUI platform's Markdown rendering component specifically in the KatexRenderer.svelte file between versions 0.10.0 and 0.11.0. This flaw represents a critical security issue that stems from improper error handling during mathematical expression processing. When users submit chat messages containing malformed math blocks, the KaTeX library encounters a stack overflow condition rather than gracefully failing with a parse error as expected. The application's error handling mechanism fails to properly catch this specific exception scenario, leading to unintended code execution paths.
The technical implementation flaw occurs when the application processes mathematical expressions through KaTeX rendering. During stack overflow conditions, the catch block executes but implements an incorrect fallback mechanism that directly injects the original math source content into the page using the {html} directive instead of proper text escaping. This represents a classic cross-site scripting vulnerability where untrusted input is rendered without appropriate sanitization. The use of {html} directive bypasses standard HTML escaping mechanisms, allowing arbitrary JavaScript code embedded within mathematical expressions to execute in the context of the victim's browser session.
The operational impact of this vulnerability extends beyond simple code execution to full session hijacking capabilities. When a malicious user crafts a math block that triggers the stack overflow condition and subsequently executes JavaScript through the improper HTML injection, any viewer who accesses the affected chat message becomes vulnerable to attack. The stolen session tokens stored in localStorage can be exfiltrated and used by attackers to impersonate legitimate users. This risk is particularly severe in shared chat environments where multiple users may view the same malicious content. Administrators are especially vulnerable since their accounts can be fully compromised, potentially allowing attackers to gain elevated privileges within the system.
This vulnerability maps directly to CWE-79 Cross-site Scripting and CWE-352 Cross-Site Request Forgery categories, with ATT&CK techniques including T1059 Command and Scripting Interpreter for executing malicious code and T1531 Account Access Removal for session hijacking. The attack vector specifically aligns with T1213 Data from Information Repositories, as the vulnerability exploits shared chat channels to propagate malicious payloads. The remediation implemented in version 0.11.0 addresses this by properly handling KaTeX error conditions and ensuring that fallback rendering occurs through safe text insertion rather than HTML injection mechanisms. Organizations should immediately upgrade to version 0.11.0 or later to mitigate this risk, while also implementing additional monitoring for unusual chat message patterns that might indicate attempted exploitation of similar vulnerabilities in other components.