Description
KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.
Recommendation
Update the katex package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.12.0, <= 0.16.20
- Patched version(s): 0.16.21
References
Could your website be exposed too?
SmartScanner can check your website for KaTeX \htmlData does not validate attribute names and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte SSR does not validate dynamic element tag names in `<svelte:element>` - CVE-2026-27122
- Payload does not invalidate JWTs after log out - payload - CVE-2025-4643
- Payload does not invalidate JWTs after log out - @payloadcms/next - CVE-2025-4643
- expr-eval does not restrict functions passed to the evaluate function - CVE-2025-12735
You might also like:
See something that needs correcting? Let us knowUpdated September 10, 2025