GitHub Advisoryadvisory · npm

GHSA-qwj6-q94f-8425 MathLive's Lack of Escaping of HTML allows for XSS

MEDIUM Published 2025-01-21 Modified 2025-04-02 Official page ↗
Aliases
CVE-2025-29049
Ecosystem
npm
Packages
mathlive
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-116, CWE-79
Reviewed
2025-01-21

Affected packages

• npm mathlive: < 0.104.0 → fixed in 0.104.0

Description

Summary Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the `\htmlData` command, and the lack of escaping leads to XSS. Details Overall in the code, other than in the `test` folder, no functions escaping HTML can be seen. PoC 1. Go to https://cortexjs.io/mathlive/demo/ 2. Paste either `\htmlData{>}{}` in the LaTeX textarea. Impact MathLive users who render untrusted mathematical expressions could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.

Related

Alias · CVE (1)

  • CVE-2025-29049 Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute… vulnerability

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References