Executive brief
KaTeX is a popular JavaScript math rendering library used to display mathematical equations in web applications. The \htmlData command in KaTeX fails to validate attribute names before generating HTML, allowing attackers who can inject untrusted mathematical expressions to create malicious HTML that executes arbitrary JavaScript or generates invalid markup in rendered output.
Technical details
KaTeX's \htmlData command does not properly validate attribute name arguments before generating HTML output (CWE-116: Improper Encoding or Escaping of Output). This allows injection of malicious attributes through unvalidated input when rendering untrusted mathematical expressions via renderToString. The vulnerability impacts applications that enable the trust option and process user-controlled math expressions. An attacker can craft expressions that generate invalid or script-executing HTML attributes. The vulnerability affects versions 0.12.0 through 0.16.20 and is resolved in v0.16.21.
Affected products
- KaTeX KaTeX 0.12.0 to 0.16.20
Timeline
- 2025-01-17: disclosed: GHSA-cg87-wmx4-v546 published
- 2025-01-17: patched: KaTeX v0.16.21 released with fix