Executive brief
MathLive is a JavaScript library that renders mathematical expressions using LaTeX. The library provides an \htmlData command that allows embedding HTML content without proper escaping, enabling attackers to inject malicious JavaScript code. Users who render untrusted mathematical expressions are at risk of arbitrary code execution.
Technical details
MathLive fails to escape HTML output when processing the \htmlData LaTeX command, resulting in a cross-site scripting (XSS) vulnerability (CWE-116, CWE-79). An attacker can craft malicious LaTeX input using \htmlData with embedded HTML/JavaScript payloads (e.g., \htmlData{><img/onerror=alert(1)"src=}{}) to execute arbitrary JavaScript in the context of a web application. The vulnerability requires the victim to render an untrusted mathematical expression, with no additional privileges required. The vulnerability affects all versions up to and including 0.103.0, and is patched in version 0.104.0.
Affected products
- Arnog MathLive <=0.103.0
Timeline
- 2025-01-18: disclosed
- 2025-01-21: patched: Fixed in version 0.104.0