CVE-2024-28245

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
GitHub_MCNA
6.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
VendorProductVersion
katexkatex
0.11.0 ≤
𝑥
< 0.16.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
node-katex
bullseye
no-dsa
bookworm
no-dsa
forky
0.16.10+~cs6.1.0-2
fixed
sid
0.16.10+~cs6.1.0-2
fixed
trixie
0.16.10+~cs6.1.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-katex
plucky
not-affected
oracular
not-affected
noble
not-affected
mantic
ignored
jammy
Fixed 0.13.11+~cs6.0.0-2ubuntu0.1~esm1
released
focal
not-affected
bionic
not-affected
Common Weakness Enumeration
References
https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770
https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h
https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770
https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h