PyPI/open-webui CVE-2026-70492: high 8.7, EPSS 0.40%

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Action: Upgrade open-webui to 0.11.0 or later.

pip install open-webui==0.11.0

Affected

Fixed versions

Sources

• osv: GHSA-pwxh-7358-jq2x
• https://github.com/open-webui/open-webui/security/advisories/GHSA-pwxh-7358-jq2x
• https://github.com/open-webui/open-webui/pull/26718
• https://github.com/open-webui/open-webui/commit/bc600d3f085802c45aa8f38c30e6e8c986bde6cc
• https://github.com/open-webui/open-webui
• https://github.com/open-webui/open-webui/releases/tag/v0.11.0

CVE-2026-70492 · published 2026-08-04T20:54:17Z · modified 2026-08-10T11:40:47.190156486Z · JSON