Mathjax
Monthly
Cross-site scripting in the Drupal contrib module 'MathJax: LaTeX for Drupal' (versions 0.0.0 through 4.1.2) lets an attacker get an unsanitized payload rendered into a generated page, executing script in a victim's browser session; the victim must view the affected page (UI:R), which limits this to opportunistic or social-engineering delivery rather than silent mass exploitation. Impact is bounded to low confidentiality and integrity loss in the victim's browser context with no availability impact, and the assessed vector requires a low-privileged authenticated position (PR:L) even though the published score lists PR:N. There is no CISA KEV entry and no public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), and the vendor has released a fixed version.
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site scripting in the Drupal contrib module 'MathJax: LaTeX for Drupal' (versions 0.0.0 through 4.1.2) lets an attacker get an unsanitized payload rendered into a generated page, executing script in a victim's browser session; the victim must view the affected page (UI:R), which limits this to opportunistic or social-engineering delivery rather than silent mass exploitation. Impact is bounded to low confidentiality and integrity loss in the victim's browser context with no availability impact, and the assessed vector requires a low-privileged authenticated position (PR:L) even though the published score lists PR:N. There is no CISA KEV entry and no public exploit identified at time of analysis; EPSS is 0.15% (4th percentile), and the vendor has released a fixed version.
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.