Macro in MathJax running untrusted Javascript within a web browser

Description

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax.

Recommendation

Update the mathjax package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.7.4
• Patched version(s): 2.7.4

References

• GHSA-3c48-6pcv-88rm
• blog.bentkowski.info
• CVE-2018-1999024
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access - CVE-2018-25058
• happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript - CVE-2025-62410
• Malicious PDF can inject JavaScript into PDF Viewer - CVE-2018-5158
• Nuxt vulnerable to remote code execution via the browser when running the test locally - CVE-2024-34344

Tags:

npm

mathjax