Description (CNA)
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| KaTeX / KaTeX | affected >= 0.11.0, < 0.6.10 |
CWE
CWE-116
References
- https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h
- https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.