Medium severity · published Mar 25, 2024
CVE-2024-28246
KaTeX is a JavaScript library for TeX math rendering on the web
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KA
Katex · Katex
0.11.0 before 0.16.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28246
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28246
Patch
https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de
Mitigation
https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329
More from Katex
7.2
CVE-2025-23207
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web
6.5
CVE-2024-28244
KaTeX is a JavaScript library for TeX math rendering on the web
6.5
CVE-2024-28243
KaTeX is a JavaScript library for TeX math rendering on the web
6.1
CVE-2024-28245
KaTeX is a JavaScript library for TeX math rendering on the web
2.1
CVE-2026-103923
KaTeX: Existing prototype pollution can bypass trust restrictions