Description
Despite the 0.104.0 patch escaping attribute-bearing constructs (\htmlData, \href), text-content reflection was missed. The \text{}, \mbox{} commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS.
Recommendation
Update the mathlive package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.109.2
- Patched version(s): 0.110.0
References
Could your website be exposed too?
SmartScanner can check your website for mathlive's Lack of Escaping of HTML allows for XSS - mathlive and gives you actionable findings to investigate.
Start a free scanRelated Issues
- MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
- Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591
- Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
- CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028
You might also like:
See something that needs correcting? Let us knowUpdated July 29, 2026