KaTeX \htmlData does not validate attribute names

Description

KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.

Recommendation

Update the katex package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.12.0, <= 0.16.20
• Patched version(s): 0.16.21

References

• GHSA-cg87-wmx4-v546
• CVE-2025-23207
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Svelte SSR does not validate dynamic element tag names in `<svelte:element>` - CVE-2026-27122
• Payload does not invalidate JWTs after log out - CVE-2025-4643
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) - CVE-2025-4643
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643

Tags:

npm

katex