How to fix CVE-2025-23207?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Is Katex affected by CVE-2025-23207?

Organizations using KaTeX should be aware of moderate risk from CVE-2025-23207 rated CVSS 6.3. Exploitation could compromise the security of affected deployments. A patch is available and should be applied during regular vulnerability management.

Katex CVE-2025-23207

MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2025-01-17 [email protected]

Information Disclosure Katex Redhat

6.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:04 vuln.today

Patch released

Mar 28, 2026 - 18:04 nvd

Patch available

CVE Published

Jan 17, 2025 - 22:15 nvd

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

633 npm packages depend on katex (158 direct, 486 indirect)

Ecosystem-wide dependent count for version 0.12.0.

DescriptionNVD

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

AnalysisAI

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-116. KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX. Affected products include: Katex.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Vendor StatusVendor

CVE-2025-23207 vulnerability details – vuln.today

Back