KaTeX's `\includegraphics` does not escape filename

Description

KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML.

Recommendation

Update the katex package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.11.0, < 0.16.10
• Patched version(s): 0.16.10

References

• GHSA-f98w-7cxr-ff2h
• CVE-2024-28245
• CWE-116
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• KaTeX \htmlData does not validate attribute names - CVE-2025-23207
• KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols - CVE-2024-28246
• KaTeX's maxExpand bypassed by `\edef` - CVE-2024-28243
• Vite's `server.fs.deny` did not deny requests for patterns with directories. - CVE-2024-31207

Tags:

npm

katex