Loading story…
Open WebUI disclosed and fixed CVE-2026-70492, a high-severity stored cross-site scripting flaw affecting versions 0.10.0 through before 0.11.0. The bug was traced to src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte, where KaTeX rendering failures could cause the application to insert the original math source into the page through an unescaped {@html} path instead of safely rendering it as text. The vulnerability is rated CVSS 8.7 and classified as CWE-79.
An attacker able to submit a crafted chat message could trigger script execution in the browser of anyone viewing the message, including users in shared chats and channels, creating a path to steal session tokens from localStorage and potentially take over administrator accounts. The issue was reachable through normal message rendering, including malformed or deeply nested brace input that caused non-ParseError KaTeX failures such as RangeError. Open WebUI addressed the flaw by escaping the fallback content rather than injecting it as HTML, and the fix was merged under pull request #26718 before release in version 0.11.0.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-70492 was published, describing a high-severity stored XSS vulnerability in Open WebUI with a CVSS v3.1 score of 8.7. The advisory linked the issue to GitHub Security Advisory GHSA-pwxh-7358-jq2x and recommended updating to version 0.11.0 or later.
The stored XSS vulnerability affecting Open WebUI versions 0.10.0 through before 0.11.0 was fixed in version 0.11.0. The issue could allow crafted chat messages to execute script in other users' browsers and potentially enable administrator account takeover.
Open WebUI merged pull request #26718 into the dev branch, fixing a stored cross-site scripting flaw in the KaTeX render-error fallback by escaping raw math source instead of injecting it as HTML. The merge was recorded as commit bc600d3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple high-severity vulnerabilities in **Open WebUI** allow attackers to plant malicious chat content that executes when viewed, leading to theft of JWTs and session tokens from `localStorage`, full account takeover, and compromise of sensitive AI assets. The flaws affect markdown rendering, citation and response iframe handling, and HTML file-serving paths, including cases where attacker-controlled content was rendered with dangerous HTML processing or iframe sandbox settings such as `allow-scripts allow-forms allow-same-origin`. Reported impacts include exposure of DOM data, `indexedDB`, cookies, backend API keys, model parameter files, private databases, and other enterprise AI resources. Several reports warn that if an administrator opens a malicious shared transcript or chat, the attack can escalate from stored XSS to **remote code execution** through Open WebUI's administrative features and Python-based functions or plugins, potentially yielding code execution on the Docker container or local host. The issues were addressed across releases including **v0.6.6** and **v0.7.0** by tightening file ownership checks, removing or making optional same-origin iframe access, and recommending stronger HTML sanitization and restrictive CSP settings; one report also provided a database query to hunt for stored chats containing suspicious `data:text/html` or `javascript:` embed payloads.
Jul 7, 2026
A vulnerability tracked as **CVE-2026-44990** allows stored cross-site scripting in `sanitize-html` when applications use the library’s default configuration and later render sanitized user content as trusted HTML. The flaw affects versions prior to **2.17.4** and stems from the handling of the disallowed `xmp` element: because `htmlparser2` treats `xmp` as a raw-text tag, attacker-supplied markup inside it is preserved as text during sanitization but can be emitted back as active HTML or JavaScript under the default `disallowedTagsMode: 'discard'` behavior. GitHub’s advisory and the upstream patch say the bypass can let payloads such as `<script>`, `img` event handlers, and `svg`-embedded script content survive filtering and execute in a victim’s browser. The fix in **2.17.4** adds `xmp` to `nonTextTags` so content inside a disallowed `xmp` tag is dropped instead of re-emitted, and regression tests were added to confirm the malicious content is removed. The issue was reported by **Vincenzo Turturro** (`sushi-gif`), and users of affected `sanitize-html` deployments, including those in **ApostropheCMS**, were urged to update immediately.
Jun 29, 2026
A critical vulnerability, CVE-2025-64495, has been identified in Open WebUI, a self-hosted AI web interface framework. The flaw is a stored DOM-based cross-site scripting (XSS) issue in the "Insert Prompt as Rich Text" feature, which allows attackers to inject malicious scripts. If exploited, this vulnerability can lead to remote code execution (RCE) with administrative privileges when an admin interacts with a crafted prompt, posing a significant risk to organizations using Open WebUI for managing AI workflows and data. Security researchers have published proof-of-concept (PoC) details and technical analysis demonstrating how the vulnerability can be leveraged to compromise the system. The issue highlights the importance of sanitizing user input in web applications, especially those handling sensitive AI operations. Administrators are urged to apply available patches and review their Open WebUI deployments to mitigate the risk of exploitation.
Jul 12, 2026