CVE-2026-54705
CVE-2026-54705 · mathlive's Lack of Escaping of HTML allows for XSS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.
CVSS 6.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node