GitHub Advisoryadvisory · npm

GHSA-3c48-6pcv-88rm Macro in MathJax running untrusted Javascript within a web browser

MEDIUM Published 2018-07-27 Modified 2023-09-11 Official page ↗
Aliases
CVE-2018-1999024
Ecosystem
npm
Packages
mathjax
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm mathjax: < 2.7.4 → fixed in 2.7.4

Description

MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the `\unicode{}` macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.

Related

Alias · CVE (1)

  • CVE-2018-1999024 MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References