mathlive's Lack of Escaping of HTML allows for XSS - mathlive

Description

Despite the 0.104.0 patch escaping attribute-bearing constructs (\htmlData, \href), text-content reflection was missed. The \text{}, \mbox{} commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS.

Recommendation

Update the mathlive package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.109.2
• Patched version(s): 0.110.0

References

• GHSA-fm7p-gw32-828p
• CVE-2026-54705
• CWE-116
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• MathLive's Lack of Escaping of HTML allows for XSS - CVE-2025-29049
• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - CVE-2026-41591
• Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping - marko - CVE-2026-41591
• CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS - CVE-2026-26028

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

mathlive