MathLive's Lack of Escaping of HTML allows for XSS

Description

Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command, and the lack of escaping leads to XSS.

Recommendation

Update the mathlive package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.103.0
• Patched version(s): 0.104.0

References

• GHSA-qwj6-q94f-8425
• CVE-2025-29049
• CWE-116
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Atro CSRF Middleware Bypass (security.checkOrigin) - CVE-2024-56140
• SillyTavern Web Interface Vulnerable DNS Rebinding - CVE-2025-59159
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• Better Call routing bug can lead to Cache Deception - Vulnerability

Tags:

npm

mathlive