Description
KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.
Recommendation
Update the katex package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.12.0, <= 0.16.20
- Patched version(s): 0.16.21
References
Related Issues
- Svelte SSR does not validate dynamic element tag names in `<svelte:element>` - CVE-2026-27122
- KaTeX's `\includegraphics` does not escape filename - CVE-2024-28245
- Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
- vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892
You might also like:
- Tags:
- npm
- katex
Anything's wrong? Let us know Last updated on September 10, 2025