p PatchFirst

CVE-2024-28245

CVE-2024-28245 · KaTeX's \includegraphics does not escape filename

This page contains facts from public vulnerability sources. Check the original advisory before updating.

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

CVSS 6.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • katex

    Versions
    • >= 0.11.0, < 0.6.10: Affected

    No fix published

  • node-katex Debian:12

    Versions
    • 0.16.10+~cs6.1.0-1
    • 0.16.10+~cs6.1.0-2
    • 0.16.10+~cs6.1.0-3
    • 0.16.10+~cs6.1.0-4
    • 0.16.10+~cs6.1.0-5
    • 0.16.10+~cs6.1.0-6
    • 0.16.10+~cs6.1.0-7
    • 0.16.10+~cs6.1.0-8
    • 0.16.10+~cs6.1.0-9
    • 0.16.4+~cs6.1.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-katex Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.16.10+~cs6.1.0-1

    Update to 0.16.10+~cs6.1.0-1

  • node-katex Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.16.10+~cs6.1.0-1

    Update to 0.16.10+~cs6.1.0-1

  • katex npm

    Affected ranges
    • SEMVER: ≥ 0.11.0, < 0.16.10

    Update to 0.16.10

  • node-katex Ubuntu:Pro:22.04:LTS

    Versions
    • 0.10.2+dfsg-8
    • 0.10.2+dfsg-9
    • 0.10.2+dfsg-10
    • 0.13.11+~cs6.0.0-2
    Affected ranges
    • ECOSYSTEM: < 0.13.11+~cs6.0.0-2ubuntu0.1~esm1

    Update to 0.13.11+~cs6.0.0-2ubuntu0.1~esm1

Original sources

Check your server →