MathLive's Lack of Escaping of HTML allows for XSS

Description

Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command, and the lack of escaping leads to XSS.

Recommendation

Update the mathlive package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.103.0
• Patched version(s): 0.104.0

References

• GHSA-qwj6-q94f-8425
• CVE-2025-29049
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
• QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954
• Atro CSRF Middleware Bypass (security.checkOrigin) - CVE-2024-56140

Tags:

npm

mathlive