CVE-2026-70492 Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte could store and render a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Th...

Malicious Package

Overview error-fallback is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-205823

Malicious code in error-fallback npm...

Malicious code in error-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bcddff3dd9b13e5fc8e37afd8432e9485d1204cb5cd6a546a46e4580371f929 The package error-fallback was found to contain malicious code. Source: ghsa-malware b9c747aad11a6b98fa9f2fb07cb9410f6bc4e51390f358f1ff5d546c14b08134...

MAL-2025-192985 Malicious code in error-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bcddff3dd9b13e5fc8e37afd8432e9485d1204cb5cd6a546a46e4580371f929 The package error-fallback was found to contain malicious code. Source: ghsa-malware b9c747aad11a6b98fa9f2fb07cb9410f6bc4e51390f358f1ff5d546c14b08134...

Malicious Package

Overview error-fallback is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...