Katex
Monthly
Prototype-pollution-assisted cross-site scripting in the KaTeX math-rendering JavaScript library (versions 0.11.0 through 0.18.2) lets attacker-controlled expressions end up in trusted-rendering mode when an inherited `trust` property is picked up from a polluted prototype, producing clickable `javascript:` links or attacker-chosen external resources in any consuming page that inserts unsanitized KaTeX output. This is not a standalone remote exploit: KaTeX does not create the prototype pollution itself, so a separate pollution primitive (or attacker control over the options object's prototype) must already exist in the host application, rendering an expression alone never executes script, and script execution requires the victim to actively click a crafted link. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the CVSS 4.0 base score is only 2.1 (our independent 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the compounding prerequisites rather than a broadly reachable XSS bug.
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Prototype-pollution-assisted cross-site scripting in the KaTeX math-rendering JavaScript library (versions 0.11.0 through 0.18.2) lets attacker-controlled expressions end up in trusted-rendering mode when an inherited `trust` property is picked up from a polluted prototype, producing clickable `javascript:` links or attacker-chosen external resources in any consuming page that inserts unsanitized KaTeX output. This is not a standalone remote exploit: KaTeX does not create the prototype pollution itself, so a separate pollution primitive (or attacker control over the options object's prototype) must already exist in the host application, rendering an expression alone never executes script, and script execution requires the victim to actively click a crafted link. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the CVSS 4.0 base score is only 2.1 (our independent 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the compounding prerequisites rather than a broadly reachable XSS bug.
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
KaTeX is a JavaScript library for TeX math rendering on the web. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.