Executive brief
KaTeX is a JavaScript library for rendering mathematical equations in web browsers. A flaw in its maxExpand protection mechanism allows attackers to bypass expansion limits by using Unicode superscript and subscript characters, causing malicious mathematical expressions to trigger infinite loops that consume memory and freeze the page, denying legitimate users access to affected sites.
Technical details
The vulnerability is a resource exhaustion (denial of service) attack that bypasses KaTeX's maxExpand safety mechanism. The root cause is that each Unicode sub/superscript group instantiates a separate Parser instance with its own independent macro execution counter, rather than inheriting and respecting the parent parser's cumulative macro expansion count. An attacker who can inject untrusted mathematical expressions (via \def or \newcommand macros) using Unicode superscript/subscript characters can trigger near-infinite loops despite maxExpand being configured. This results in stack overflow, memory exhaustion, or main-thread blocking. The vulnerability affects KaTeX versions 0.15.4 through 0.16.9 and is fixed in v0.16.10. No special privileges or user interaction are required beyond rendering the malicious input.
Affected products
- KaTeX KaTeX 0.15.4 to 0.16.9
Timeline
- 2024-03-25: disclosed
- 2024-03-25: patched: KaTeX v0.16.10 released