Junglewise Threat Intelligence

markdown-it-katex cross-site scripting in error messages

Severity: info · CVSS 6.1 · Published 2020-09-04

Vendors: npm.

Executive brief

markdown-it-katex is a popular JavaScript library that adds mathematical equation rendering to markdown. When the library encounters a malformed math expression, it fails to properly sanitize the error message before displaying it to users, allowing attackers to inject and execute malicious JavaScript. This could enable account takeover, credential theft, or malware distribution if the vulnerable library is used in web applications that render user-supplied markdown.

Technical details

The vulnerability is a Stored/Reflected Cross-Site Scripting (XSS) weakness in CWE-79. The root cause is in the error handling path of the markdown-it-katex index.js file (line 168): when the KaTeX parser fails on a malformed math expression, the error message is returned as unsanitized HTML. An attacker can trigger the catch block by creating syntactically invalid math (e.g., `

amp;lt;img src=a onerror=alert(1)>% Junglewise ) that causes KaTeX to throw an error; the embedded HTML tags in the math text are then rendered without escaping. The attack requires no authentication and can be delivered through any markdown input that reaches the parser (e.g., comments, notes, user-generated content). An attacker can achieve arbitrary JavaScript execution in the context of the victim's browser session. No patch has been released as of the advisory publication date (2020-09-04); the maintainer recommends using alternative packages.

Affected products

  • waylonflinn markdown-it-katex all versions (0.0.0+)

Timeline

  • 2019-02-26: disclosed: Vulnerability reported in GitHub issue #26
  • 2020-09-04: advisory: GHSA-5ff8-jcf9-fw62 advisory published on GitHub

References