CVE-2026-70492: Open WebUI: KaTeX fallback XSS steals admin session

## Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the browser of whoever views it. Every surface that renders messages is affected, including shared chats and channels, and the missing control is output escaping on the error path. ## Preconditions Default configuration, no flags involved. The attacker needs a normal user account and a way to get the target to open the content: a shared chat link, a channel the target reads, or any other message surface. No admin rights and no non-default settings are required on either side. ## Impact Script executes in the viewer's browser on the Open WebUI origin, which puts the session token in localStorage within reach and therefore allows taking over the viewing account. If the viewer is an administrator, that is administrator access to the instance. Exploitation needs the target to open the content, but nothing beyond that: no interaction with the message itself. Server-side data and availability are unaffected; the impact is entirely in the viewer's browser session. ## Fix Fixed in 0.11.0 by commit bc600d3f0 (PR #26718). The error path now HTML-escapes the math source before it reaches the DOM, so a failed render displays the formula as text instead of as markup. Upgrading fully resolves the issue; no configuration change is needed. ## Root cause Affected component: `src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte`, the reactive block that renders math and its `catch` branch. Affected setup: releases 0.10.0 through 0.10.2, which are the versions carrying that fallback. KaTeX was called with `throwOnError: false`, which suppresses parse errors but not a `RangeError` from deeply nested input. The surrounding `catch` treated any failure as "show the original formula" and assigned the untouched source to the value that the template inserts with `{@html}`. Because the Markdown math tokenizer captures everything between the delimiters verbatim, including angle brackets and complete tags, the attacker controls that string exactly. ## Proof of concept Send a chat message (or store one via any endpoint that writes message content) consisting of a single inline math block: an opening `$`, 100000 `{` characters, an `<img src=x onerror=alert(document.domain)>` tag, 100000 `}` characters, and a closing `$`. ``` python3 -c 'N=100000; print("$"+"{"*N+"<img src=x onerror=alert(document.domain)>"+"}"*N+"$")' ``` Open the chat as any user who can view it. KaTeX overflows the stack, the fallback inserts the raw source, and the `onerror` handler fires. Replacing `alert()` with a request carrying `localStorage.token` sends the viewer's session token to an attacker-controlled host; this was demonstrated against a shared chat opened by an administrator account. ## Credits @maxntv — reported the unescaped KaTeX error fallback and demonstrated session-token theft through a shared chat.

An attacker signs up for a normal, unprivileged account on a target's Open WebUI instance (or compromises a low-privilege account). They craft a chat message consisting of a math block with 100,000 nested `{` characters, an embedded `<img src=x onerror=...>` tag that exfiltrates `localStorage.token` to an attacker-controlled endpoint, and 100,000 closing `}` characters, then share the chat link with — or post it in a channel read by — a target administrator. When the administrator opens the link, KaTeX's stack overflows, the app's catch handler inserts the raw source via `{@html}` instead of escaping it, and the `onerror` handler fires silently, sending the admin's session token to the attacker. The attacker then replays that token to gain full administrative access to the instance, including user accounts, connected model/API credentials, and any integrated data sources.