CVE-2026-54705
CVE-2026-54705 · mathlive's Lack of Escaping of HTML allows for XSS
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.
CVSS 6.3 · Media · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node