Macro in MathJax running untrusted Javascript within a web browser

Description

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax.

Recommendation

Update the mathjax package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.7.4
• Patched version(s): 2.7.4

References

• GHSA-3c48-6pcv-88rm
• blog.bentkowski.info
• CVE-2018-1999024
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vite has an `server.fs.deny` bypass with an invalid `request-target` - CVE-2025-32395
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Marp Core allows XSS by improper neutralization of HTML sanitization - CVE-2024-56510
• bootstrap Cross-site Scripting vulnerability (GHSA-ph58-4vrj-w6hr) 2 - CVE-2018-20677

Tags:

npm

mathjax