Drupal MathJax CVE-2026-107252

Exploitation requires the MathJax: LaTeX for Drupal module (any version from 0.0.0 up to but not including 4.1.2) to be installed and enabled, and depends on an attacker-controlled payload being processed through the module's LaTeX page-generation path. The CVSS vector requires victim user interaction (UI:R) - a user must view the page containing the unsanitized payload - which limits exploitation to opportunistic or social-engineering delivery rather than silent mass exploitation. The exact prerequisite for injecting the payload (e.g., which Drupal permission or content/comment field feeds the vulnerable LaTeX renderer) is not described in the available sources; although the provided vector lists PR:N, whether genuinely unauthenticated input reaches the sink is unverified and should be confirmed against SA-CONTRIB-2026-195. Impact is bounded to the victim's browser context (low confidentiality and integrity, no availability impact).

This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79) in the Drupal contrib module 'MathJax: LaTeX for Drupal', scored CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N). The signals are internally consistent and point to a real-but-not-urgent issue rather than an emergency. The CVSS vector indicates network reachability with low attack complexity but requires user interaction (UI:R), and impact is limited to low confidentiality and low integrity with no availability impact - characteristic of browser-context script injection rather than server compromise. EPSS reinforces low real-world exploitation pressure at 0.15% (4th percentile), and there is no CISA KEV listing, so there is no confirmed active exploitation. The vuln.today decision label is 'this_month', indicating a routine patch priority, not act_now/emergency. One tension to flag explicitly: the vector states PR:N (no privileges), yet XSS in a LaTeX-rendering Drupal module typically depends on an attacker being able to submit content containing the malicious payload - the sources do not describe the exact trigger, so whether truly unauthenticated input reaches the sink is not confirmed from available data and should be verified against the Drupal advisory SA-CONTRIB-2026-195. Overall this is a legitimate but low-urgency issue: patch within the normal cycle.

An attacker supplies crafted LaTeX/markup containing a malicious script payload that the module fails to neutralize when generating the page; when a victim user views the rendered content, the script executes in their browser session. Because the CVSS vector requires user interaction (UI:R) and yields only low confidentiality/integrity impact, realistic outcomes are session/cookie theft or limited actions in the victim's context rather than server takeover. A public PoC reference exists (vuldb.com/vuln/428860); it is not verified as working exploit code, and the exact trigger is not described in the available sources.