Executive brief
KaTeX is a popular JavaScript library used to display mathematical formulas on websites. A security flaw in how it handles web links allows attackers to bypass security filters by using uppercase letters in link protocols (like using 'Javascript:' instead of 'javascript:'). This could allow an attacker to inject malicious scripts into a page, potentially leading to unauthorized actions or data theft when a user clicks a link.
Technical details
KaTeX contains a vulnerability where the 'trust' option, used to filter or block-list specific URL protocols, fails to normalize the protocol string to lowercase before evaluation. An attacker can bypass security filters that check for forbidden protocols (such as 'javascript:') by providing mixed-case or uppercase versions (e.g., 'JAVASCRIPT:'). This occurs because the internal context object provided to the user-specified trust function treats 'file:' and 'File:' as distinct. If a developer uses a block-list approach for security, an attacker can successfully inject malicious links. The issue is resolved in version 0.16.10 by forcing protocols to lowercase during the filtering process.
Affected products
- KaTeX katex >= 0.11.0, < 0.16.10
Timeline
- 2024-03-24: patched: Fix committed to repository
- 2024-03-25: advisory: GitHub Security Advisory published