CVE-2026-70492

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-70492

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70492.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-70492

Aliases

Published

2026-08-04T20:53:36.141Z

Modified

2026-08-12T03:51:28.755548551Z

Severity

8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator

Summary

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Details

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. The catch branch fell back to inserting the original math source into the page as HTML through {@html} rather than as text, so script in the message runs in the browser of whoever views it, including shared chats and channels. The viewer's session token in localStorage can be stolen, and an administrator viewer can have their account taken over. This issue is fixed in 0.11.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/70xxx/CVE-2026-70492.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

4d2e13cf2bcc451b33bb6374bea4d2163e6cc94c

Fixed

bc600d3f085802c45aa8f38c30e6e8c986bde6cc

Fixed

f9590b8017199e56d5e953657e6498e3cef1d246

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.10.0"
        },
        {
            "fixed": "0.11.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-70492.json"