Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2024-28245

KaTeX's \includegraphics does not escape filename

Description

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

KaTeX KaTeX

  • >= 0.11.0, < 0.6.10affected

References