high · 8.7CVE-2026-70492Aug 4, 2026

CVE-2026-70492: open-webui Stored XSS via KaTeX Render-Error Fallback

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A chat message crafted to crash the KaTeX math renderer causes Open WebUI to paste raw HTML from the message directly into the page, letting any authenticated user run JavaScript in a viewer's…

Packageopen-webui
Ecosystempip
Affected>= 0.10.0, < 0.11.0
Fixed in0.11.0
CVE-2026-70492: open-webui Stored XSS via KaTeX Render-Error Fallback

The problem

Open WebUI versions 0.10.0 through 0.10.2 render math blocks using KaTeX inside KatexRenderer.svelte. KaTeX is configured with throwOnError: false, which suppresses normal parse errors but does not prevent a RangeError from deeply nested input.

When the renderer throws, the catch branch falls back to assigning the original, un-escaped math source directly to a Svelte {@html} binding. Because the Markdown tokenizer captures everything between the $ delimiters verbatim, an attacker controls the full string, including angle brackets and complete HTML tags.

Every surface that renders messages is affected: personal chats, shared chat links, and channels. If the viewer is an administrator, the attacker gains administrator-level access to the instance.

Proof of concept

A working proof-of-concept for CVE-2026-70492 in open-webui, with the exact payload below.

bash
python3 -c 'N=100000; print("$"+"{"*N+"<img src=x onerror=alert(document.domain)>"+"}"*N+"$")'

The payload opens an inline math block, then supplies 100,000 { characters before the injected tag and 100,000 } characters after it. That nesting depth causes KaTeX to hit a call-stack RangeError instead of a normal parse failure, which throwOnError: false would have swallowed safely.

The catch block had no escaping step: it passed the raw source string to {@html}, so the browser parsed <img src=x onerror=...> as markup and fired the handler. The fix in commit bc600d3f0 (PR #26718, released in 0.11.0) HTML-escapes the math source before it reaches {@html} on the error path, so a failed render now displays the literal formula text instead of live markup.

CWE-79 (Stored XSS), root cause: missing output encoding on an exception path.

The fix

Upgrade to open-webui 0.11.0. The patch is in commit bc600d3f085802c45aa8f38c30e6e8c986bde6cc. No configuration change is needed; upgrading fully resolves the issue.

Reported by @maxntv.

References: [1][2][3][4][5]

Related research