Open WebUI versions between 0.10.0 and 0.11.0 contain a stored cross‑site scripting flaw. When a user posts a math block that causes KaTeX to fail with a stack overflow, the fallback path inserts the raw math source into the page as HTML. As a result, any JavaScript inside the message runs in the browser of anyone who views the chat, including shared channels. The injected script can read the viewer’s session token stored in localStorage and perform an account takeover, which is especially dangerous for administrators.

The vulnerability affects the Open WebUI product, specifically the open-webui open-webui library distributed in releases 0.10.0 through 0.11.0. All deployments running those released versions are susceptible until the fix in 0.11.0 is applied.

With a CVSS score of 8.7, this flaw is considered high severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a crafted math block in a stored chat message, which is relatively easy if the application allows untrusted users to post messages. Any user who subsequently opens the chat can execute the attack, making the risk low‑threshold but significant for systems that expose chat functionality to multiple or external users.