Executive brief
MathLive is a JavaScript library for rendering mathematical expressions in web applications. A cross-site scripting (XSS) vulnerability in versions prior to 0.104.0 allows attackers to inject and execute arbitrary code through improperly escaped HTML, potentially compromising user sessions, stealing data, or defacing content displayed to end users.
Technical details
This is a cross-site scripting (CWE-79) vulnerability caused by insufficient HTML escaping in the MathLive library's handling of HTML content, specifically in the \htmlData function. The vulnerable component fails to properly sanitize or escape user-controlled input before rendering it in the DOM, allowing an attacker to inject malicious JavaScript. The attack vector is network-based and does not require authentication or user interaction beyond viewing affected content. An attacker can execute arbitrary JavaScript in the context of the affected web application, potentially stealing credentials, session tokens, or sensitive user data. The vulnerability has been fixed in version 0.104.0.
Affected products
- Arno Gourdol MathLive before 0.104.0
Timeline
- 2025-04-01: disclosed
- 2025-01-18: patched: Fix committed to address XSS in \htmlData function
- 2025-04-02: other: Advisory withdrawn as duplicate of GHSA-qwj6-q94f-8425