CVE-2024-28245mediumCWE-116

CVE-2024-28245: medium-severity vulnerability in KaTeX

KaTeX's \includegraphics does not escape filename

Published · Updated

Follow this CVE+ Monitor KaTeX+ Monitor node-katex

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.4%
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
KaTeX · KaTeX
Related CVEs — KaTeX

In the same product, most dangerous first.

CVE-2024-28244MEDIUMKaTeX's maxExpand bypassed by Unicode sub/superscriptsEPSS 2.2%CVE-2024-28243MEDIUMKaTeX's maxExpand bypassed by \edefEPSS 1.4%CVE-2025-23207MEDIUM\htmlData does not validate attribute names in KaTeXEPSS 0.4%CVE-2024-28246MEDIUMKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocolsEPSS 0.4%CVE-2026-103923LOWKaTeX: Existing prototype pollution can bypass trust restrictionsEPSS 0.3%