Description
KaTeX can act as a read-side prototype pollution gadget in applications where Object.prototype has already been polluted, or where an attacker can influence the prototype of the renderer options object. (KaTeX does not enable said prototype pollution.
Recommendation
Update the katex package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.11.0, < 0.18.2
- Patched version(s): 0.18.2
References
Could your website be exposed too?
SmartScanner can check your website for KaTeX: Existing prototype pollution can bypass trust restrictions and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype pollution gadget in fetch adapter can alter outbound requests - CVE-2026-101908
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: Prototype pollution gadgets can alter axios request construction - CVE-2026-67316
- Axios: Prototype pollution auth subfields can inject Basic auth - CVE-2026-67314
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026