What is the CVSS score of CVE-2025-23207?

CVE-2025-23207 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Katex are affected by CVE-2025-23207?

Organizations using KaTeX should be aware of moderate risk from CVE-2025-23207 rated CVSS 6.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-23207?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Katex CVE-2025-23207

MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2025-01-17 security-advisories@github.com

Information Disclosure Katex Red Hat

6.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Red Hat

6.3 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:04 vuln.today

Patch released

Mar 28, 2026 - 18:04 nvd

Patch available

CVE Published

Jan 17, 2025 - 22:15 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

639 npm packages depend on katex (156 direct, 494 indirect)

Ecosystem-wide dependent count for version 0.12.0.

DescriptionGitHub Advisory

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

AnalysisAI

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-116. KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX. Affected products include: Katex.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.