Executive brief
Open WebUI, an interface for interacting with large language models, is vulnerable to a security flaw where malicious chat messages can execute unauthorized code in a user's browser. By sending a specially crafted message containing complex mathematical formulas, an attacker can bypass security filters and run scripts when another user views the chat. This could allow an attacker to steal session tokens and take over user accounts, including those with administrative privileges.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Open WebUI's KatexRenderer.svelte component. The application uses KaTeX to render mathematical notation but fails to properly escape the original source string when a rendering error (such as a RangeError from deeply nested input) occurs. An authenticated attacker can craft a message with a deeply nested math block containing malicious HTML/JavaScript; when KaTeX fails, the raw source is inserted into the DOM via a reactive block using {@html}. This allows for arbitrary script execution in the context of any user viewing the message, potentially leading to session token theft from localStorage. The issue is fixed in version 0.11.0.
Affected products
- Open WebUI open-webui >= 0.10.0, < 0.11.0
Timeline
- 2026-08-02: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched