Is CVE-2026-54705 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54705 being exploited in the wild.

How severe is CVE-2026-54705?

Medium severity, with a CVSS score of 6.3, published 29 July 2026.

Which products and versions are affected?

mathlive (npm) <= 0.109.2, SEMVER:introduced=0,fixed=0.110.0.

Is there a fix for CVE-2026-54705?

Yes. mathlive (npm): upgrade to 0.110.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54705 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54705?

Check whether you run mathlive (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54705: Arno Gourdol MathLive XSS in text-mode rendering

Q: Which products and versions are affected?

mathlive (npm) <= 0.109.2, SEMVER:introduced=0,fixed=0.110.0.

Q: Is there a fix for CVE-2026-54705?

Yes. mathlive (npm): upgrade to 0.110.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54705 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54705?

Check whether you run mathlive (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54705 · Severity: medium · CVSS 6.3 · Published 2026-07-29

MathLive is a web component library used to display and edit mathematical formulas on websites. A security flaw allows attackers to embed malicious code within math expressions that, when rendered by the library, can execute arbitrary JavaScript in a user's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: mathlive (npm). Vendors: npm.

Quick answers

Is CVE-2026-54705 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54705 being exploited in the wild.
How severe is CVE-2026-54705?: Medium severity, with a CVSS score of 6.3, published 29 July 2026.
Which products and versions are affected?: mathlive (npm) <= 0.109.2, SEMVER:introduced=0,fixed=0.110.0.
Is there a fix for CVE-2026-54705?: Yes. mathlive (npm): upgrade to 0.110.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54705 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54705?: Check whether you run mathlive (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mathlive (npm): upgrade to 0.110.0 or later
```
npm install mathlive@0.110.0
```

Technical details

A cross-site scripting (XSS) vulnerability exists in MathLive due to improper output escaping of text-mode content within commands like \\text{} and \\mbox{}. The root cause is located in Box.toMarkup and the MathML serializer, where raw characters are concatenated into the final markup without being passed through an HTML/XML escaping function. This allows an attacker to provide LaTeX input containing malicious HTML tags (e.g., <img src=x onerror=alert(1)>) that are executed when the output is inserted into the DOM via sinks like innerHTML. The vulnerability affects several public APIs including convertLatexToMarkup, convertLatexToMathMl, and static elements like <math-span>. The issue is fixed in version 0.110.0 by implementing proper escaping for text-mode atoms.

Affected products

arnog mathlive < 0.110.0

Identifiers

CVE-2026-54705
GHSA-fm7p-gw32-828p

Timeline

2026-05-29: disclosed: Issue first reported to vendor
2026-06-08: patched: Fix committed to repository
2026-06-09: advisory: GitHub Security Advisory published
2026-07-29: advisory: NVD published CVE-2026-54705

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.