# CVE-2026-70492: Open WebUI Stored XSS in KaTeX render-error fallback

Source: https://junglewise.ai/threats/cve-2026-70492-open-webui-stored-xss-in-katex-render-error-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-08-04  
License: CC BY 4.0 with a link back

CVE-2026-70492 · Severity: high · CVSS 8.7 · Published 2026-08-04

Open WebUI, an interface for interacting with large language models, is vulnerable to a security flaw where malicious chat messages can execute unauthorized code in a user's browser. By sending a specially crafted message containing complex mathematical formulas, an attacker can bypass security filters and run scripts when another user views the chat. This could allow an attacker to steal session tokens and take over user accounts, including those with administrative privileges.

Technologies: [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-70492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70492 being exploited in the wild.

**How severe is CVE-2026-70492?** High severity, with a CVSS score of 8.7, published 4 August 2026.

**Which products and versions are affected?** open-webui (PyPI) >= 0.10.0, < 0.11.0, ECOSYSTEM:introduced=0.10.0,fixed=0.11.0.

**Is there a fix for CVE-2026-70492?** Yes. open-webui (PyPI): upgrade to 0.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-70492 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-70492?** Check whether you run open-webui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- open-webui (PyPI): upgrade to 0.11.0 or later

  ```sh
  pip install "open-webui>=0.11.0"
  ```


## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in Open WebUI's KatexRenderer.svelte component. The application uses KaTeX to render mathematical notation but fails to properly escape the original source string when a rendering error (such as a RangeError from deeply nested input) occurs. An authenticated attacker can craft a message with a deeply nested math block containing malicious HTML/JavaScript; when KaTeX fails, the raw source is inserted into the DOM via a reactive block using {@html}. This allows for arbitrary script execution in the context of any user viewing the message, potentially leading to session token theft from localStorage. The issue is fixed in version 0.11.0.

## Affected products

- Open WebUI open-webui >= 0.10.0, < 0.11.0

## Identifiers

- CVE-2026-70492
- GHSA-pwxh-7358-jq2x
- PYSEC-2026-3650

## Timeline

- 2026-08-02: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched

## References

- [https://api.github.com/users/maxntv](https://api.github.com/users/maxntv)
- [https://github.com/maxntv](https://github.com/maxntv)
- [https://api.github.com/users/maxntv/gists%7B/gist_id%7D](https://api.github.com/users/maxntv/gists%7B/gist_id%7D)
- [https://api.github.com/users/maxntv/repos](https://api.github.com/users/maxntv/repos)
- [https://avatars.githubusercontent.com/u/82523299?v=4](https://avatars.githubusercontent.com/u/82523299?v=4)
- [https://api.github.com/users/maxntv/events%7B/privacy%7D](https://api.github.com/users/maxntv/events%7B/privacy%7D)

## Related threats

- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88006-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI OAuth token exchange authorization bypass](https://junglewise.ai/threats/cve-2026-88005-open-webui-oauth-token-exchange-authorization-bypass)
- [Open WebUI infinite loop denial of service in chat history reconstruction](https://junglewise.ai/threats/cve-2026-88002-open-webui-infinite-loop-denial-of-service-in-chat-history)
- [Open WebUI server-side request forgery via unvalidated HTTP redirects](https://junglewise.ai/threats/cve-2026-88001-open-webui-server-side-request-forgery-via-unvalidated-http)
- [Open WebUI denial of service via cyclic chat tree message deletion](https://junglewise.ai/threats/cve-2026-88000-open-webui-denial-of-service-via-cyclic-chat-tree-message)