CVE-2026-70492

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.10.0 through 0.10.2

Description An authenticated user can store a chat message containing a math block designed to cause a stack overflow in KaTeX. When this occurs, the src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte component fails to handle the error correctly and inserts the original math source into the page as HTML using {@html} instead of rendering it as text. This allows an attacker to execute arbitrary scripts in the browser of any user who views the message, including those viewing shared chats and channels. This can lead to the theft of session tokens from localStorage and potential account takeover, including administrator accounts.

Recommendations Update to version 0.11.0.