CVE-2025-23207mediumCWE-116

CVE-2025-23207: falha de média gravidade em KaTeX

\htmlData does not validate attribute names in KaTeX

Publicada em

Seguir esta CVE+ Monitorar KaTeX+ Monitorar node-katex

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
KaTeX · KaTeX
CVEs relacionadas — KaTeX

No mesmo produto, das mais perigosas para as menos.

CVE-2024-28244MEDIUMKaTeX's maxExpand bypassed by Unicode sub/superscriptsEPSS 2.2%CVE-2024-28243MEDIUMKaTeX's maxExpand bypassed by \edefEPSS 1.4%CVE-2024-28246MEDIUMKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocolsEPSS 0.4%CVE-2024-28245MEDIUMKaTeX's \includegraphics does not escape filenameEPSS 0.4%CVE-2026-103923LOWKaTeX: Existing prototype pollution can bypass trust restrictionsEPSS 0.3%