Description
Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command, and the lack of escaping leads to XSS.
Recommendation
Update the mathlive package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.103.0
- Patched version(s): 0.104.0
References
Could your website be exposed too?
SmartScanner can check your website for MathLive's Lack of Escaping of HTML allows for XSS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- mathlive's Lack of Escaping of HTML allows for XSS - mathlive - CVE-2026-54705
- Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS) - CVE-2025-27109
- Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
- JS Html Sanitizer allows XSS when used with contentEditable - CVE-2025-29771
You might also like:
See something that needs correcting? Let us knowUpdated April 02, 2025