Description
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax.
Recommendation
Update the mathjax package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.7.4
- Patched version(s): 2.7.4
References
Could your website be exposed too?
SmartScanner can check your website for Macro in MathJax running untrusted Javascript within a web browser and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access - CVE-2018-25058
- Pug allows JavaScript code execution if an application accepts untrusted input - CVE-2024-36361
- happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript - CVE-2025-62410
- Malicious PDF can inject JavaScript into PDF Viewer - CVE-2018-5158
You might also like:
See something that needs correcting? Let us knowUpdated September 11, 2023