CVE-2026-70493

The actual attack surface here isn't the regex engine in isolation — it's the combination of an untrusted participant being able to inject arbitrary regex patterns into a shared, event-loop-bound worker process with no resource guards, which transforms a chat collaboration feature into a multi-tenant DoS vector. This vulnerability has three conditions that should never coexist: untrusted user input flowing directly into regex pattern compilation, execution on a single-threaded event loop serving multiple concurrent users, and no timeout, complexity limit, or recursion guard on the evaluation. The CVE notes that the malicious pattern needs 'one matching uploaded file line' to trigger backtracking — meaning the attacker doesn't need to specially craft file content; any file in a reachable knowledge base with a matching line suffices. The CVSS 6.5 rating obscures a deployment-specific severity question. In single-user self-hosted instances this is low concern. But in any multi-user collaborative deployment — which is the explicit use case for Open WebUI — this is a high-severity availability failure. The event loop serialization makes the blast radius deterministic: a single malicious regex pattern freezes every pending coroutine on that worker, affecting every concurrent user, not just the attacker. This isn't probabilistic ReDoS where you hope backtracking cascades — it's a guaranteed hang for everyone routed to that worker during the window. The fix in 0.1.1.0 presumably adds either regex complexity limits, timeout enforcement on the grep operation, or a safe-pattern allowlist. The uncertainty matters: if it's only a timeout on this specific call, the underlying architectural assumption that untrusted input can reach powerful primitives remains unchallenged. More concerning is the plugin ecosystem — if third-party tools follow the same pattern of receiving raw user input and passing it to Python execution contexts, they inherit this vulnerability without being touched by the patch. Check your deployed version immediately. If you're on 0.9.6 through 0.10.x, upgrade. Audit any installed plugins or custom tools that accept user input and pass it to regex compilation or Python execution. Verify that the knowledge search endpoint enforces proper authorization — the CVE framing references 'chat participant,' which raises the question of whether unauthenticated users can reach this code path. The EPSS score of 0.00305 is low, but for self-hosted platforms the real exposure window has inverted: bounded before disclosure, now open-ended until every operator manually updates.

Reviewed through automated stages and approved by a human before publication.