KaTeX CVE-2026-103923

Exploitation is only possible when the surrounding application running KaTeX 0.11.0-0.18.2 already has a SEPARATE prototype-pollution primitive (so Object.prototype.trust, .default, or .processor can be set), OR the attacker can control the prototype of the options object passed to KaTeX; KaTeX itself does not introduce the pollution. The consuming application must also insert unsanitized KaTeX HTML output directly into the page. Even then, code execution requires the victim to actively click the resulting attacker-controlled link (javascript: URI or external resource) - rendering the expression alone does not execute script. These compounding prerequisites (external pollution source + unsanitized insertion + user click) substantially limit real-world exploitability below what a network XSS label would suggest.

This is a genuinely low-priority issue despite being an XSS-class flaw, and the signals are consistent rather than conflicting. The CVSS 4.0 base score is only 2.1, and the vector (AV:N/AC:L/AT:P/PR:N/UI:A) encodes the key limiters: AT:P reflects a mandatory precondition (Object.prototype must already be polluted by some OTHER component, since KaTeX does not create the pollution itself), and UI:A requires the victim to actively interact (click an attacker-crafted link). Impact is confined to the subsequent/consuming system (SC:L/SI:L) with no impact on KaTeX itself (VC:N/VI:N/VA:N), correctly capturing that this is a dependency-chain weakness (CWE-807, reliance on untrusted inputs in a security decision) rather than a direct code-execution bug. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied - only vendor fix code and regression tests. The practical risk is therefore contingent: it only materializes in an application that (a) already suffers a separate prototype-pollution primitive and (b) inserts unsanitized KaTeX output into the DOM. Treat as a defense-in-depth patch, not an urgent emergency.

In an application already affected by a separate prototype-pollution bug, an attacker sets Object.prototype.trust=true, then submits a math expression such as \href{javascript:alert(1)}{x}; KaTeX reads the inherited trust value, treats the link as trusted, and emits an anchor tag. When the victim clicks the rendered link, the javascript: URI executes in their session. No public exploit code was supplied - only the vendor's regression tests demonstrate the mechanism.