Summary
Open WebUI can store a chat message containing malformed mathematical markup that causes KaTeX rendering to fail and triggers an unsafe HTML fallback. When another user views the affected message, including through shared chats or channels, embedded script may execute in their browser and expose session data or enable account takeover.
Affected context
The vulnerability occurs in Open WebUI deployments that render persisted chat content through the KaTeX renderer and use an HTML-injection fallback after a rendering exception. It becomes risky when untrusted users can submit or share messages that are later viewed by other users, especially administrators, in chats or channels.
Exploit preconditions
- Attack surface: Browser-based rendering of stored chat messages, shared chats, or channel content
- Required access: Ability to submit or influence a message that other users may view
- Trigger point: Rendering of malformed math content that causes KaTeX to fail and enter the fallback path
- Why exploitation is possible: The fallback inserts attacker-controlled source as HTML instead of treating it as text, allowing browser-executable content to run in the viewer's session
Why this happens
The underlying issue is a stored cross-site scripting flaw mapped to CWE-79: Improper Neutralization of Input During Web Page Generation. When KaTeX encounters a failure condition, the error-handling path renders the original math source through an HTML sink without adequate escaping or sanitization. This converts content that should remain inert text into browser-interpreted markup.
Potential impact
- A viewer's browser session data may be exposed
- Authentication tokens stored in the browser may be stolen
- An administrator account could be taken over
- Actions may be performed in the context of an affected viewer
- Shared chats or channels may distribute the malicious content to additional users
- The integrity and confidentiality of application data may be compromised
General mitigation guidance
Mitigation should focus on maintaining a strict text-only trust boundary for user-generated mathematical content and all error paths.
Common defensive patterns include:
- Escape untrusted content before inserting it into the document
- Prefer text-node or framework-safe rendering APIs over raw HTML sinks
- Apply narrowly scoped sanitization when rich rendering is required
- Ensure exception and fallback paths enforce the same output-encoding policy as normal paths
- Limit the privileges and accessible data associated with browser sessions
- Use secure cookie and token-handling policies where feasible, reducing reliance on script-accessible session storage
- Apply the vendor-provided security correction through the organization's normal patch process
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying raw HTML rendering APIs such as Svelte's
{@html}with user-controlled data - Code review checks covering parser exceptions, fallback renderers, and alternate output paths
- Taint analysis tracing chat content into DOM or HTML sinks without contextual encoding
- Policy enforcement that prohibits unsanitized HTML insertion in message-rendering components
- Browser security controls and monitoring for unexpected script execution or access to client-side session storage
- Regression tests using malformed markup and adversarial content across both normal and error-rendering paths
