Executive brief
RaTeX is a library used to parse and render LaTeX mathematical formulas. A vulnerability in its parser allows an attacker to crash the entire application or server by providing a specially crafted formula containing non-standard characters. This results in a complete denial of service, potentially disrupting web services or batch processing pipelines that handle user-provided math content.
Technical details
The ratex-parser library fails to correctly handle multibyte UTF-8 characters when parsing the LaTeX \verb command. Specifically, the parser uses byte-based indexing (e.g., arg[1..arg.len() - 1]) to slice the verbatim argument. If a multibyte character (like 'é') is used as a delimiter, the index may land in the middle of a UTF-8 character sequence, causing a Rust panic. Because the library is often compiled with 'panic = abort', this panic terminates the entire process rather than just the active thread. This can be exploited remotely by providing a malicious LaTeX string to any service using the library. The issue is fixed in version 0.1.11 by implementing character-aware slicing.
Affected products
- erweixin/RaTeX ratex-parser < 0.1.11
Timeline
- 2026-05-31: disclosed
- 2026-07-07: advisory: GitHub Advisory published
References
- https://api.github.com/users/nikkoenggaliano
- https://github.com/nikkoenggaliano
- https://api.github.com/users/nikkoenggaliano/gists%7B/gist_id%7D
- https://api.github.com/users/nikkoenggaliano/repos
- https://avatars.githubusercontent.com/u/37658579?v=4
- https://api.github.com/users/nikkoenggaliano/events%7B/privacy%7D