Texlyre
Monthly
Stored cross-site scripting in TeXlyre 0.11.0 through 0.13.4 lets an attacker run arbitrary JavaScript in the TeXlyre origin by supplying a malicious LSP or typesetter recipe whose free-form 'icon' field carries an HTML event handler such as <img onerror=...>; the payload is stored in the user's settings and re-executes each time the tool-settings card is rendered. Exploitation requires the victim to actively import the recipe via Settings → Import (file, URL, or pasted JSON), so the attack depends on social engineering around TeXlyre's recipe-sharing feature rather than unattended remote triggering. A public PoC reference exists in the vendor advisory; it is not verified as working exploit code, the issue is not listed in CISA KEV, and success yields read/exfiltration of IndexedDB-stored project documents plus access to in-memory decrypted Git backup tokens.
Stored cross-site scripting in TeXlyre 0.11.0 through 0.13.4 lets an attacker run arbitrary JavaScript in the TeXlyre origin by supplying a malicious LSP or typesetter recipe whose free-form 'icon' field carries an HTML event handler such as <img onerror=...>; the payload is stored in the user's settings and re-executes each time the tool-settings card is rendered. Exploitation requires the victim to actively import the recipe via Settings → Import (file, URL, or pasted JSON), so the attack depends on social engineering around TeXlyre's recipe-sharing feature rather than unattended remote triggering. A public PoC reference exists in the vendor advisory; it is not verified as working exploit code, the issue is not listed in CISA KEV, and success yields read/exfiltration of IndexedDB-stored project documents plus access to in-memory decrypted Git backup tokens.