Go to packages list

mathlive

Ecosystem: npm

Downloads: 1.35 Mln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 3ModerateAffects 3 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate3 (100.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting mathlive, based on data from OSV.

Vulnerabilities affecting mathlive
IDSeveritySummaryAffected versionsPublishedSource
GHSA-fm7p-gw32-828pModeratemathlive's Lack of Escaping of HTML allows for XSS### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflection was missed. The `\text{}`, `\mbox{}` commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. ### Details `Box.toMarkup` at `src/core/box.ts:356` concatenates `this.value` into the rendered span without HTML-escaping. In text mode any literal character (`<`, `>`, `&`, `"`) is wrapped into a `TextAtom` whose `value` is the raw codepoint and lands in the markup unchanged. The MathM
  • < 0.110.0
GitHub (opens in a new tab)
GHSA-929m-phjg-qwccModerateDuplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references. ### Original Description Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
  • < 0.104.0
GitHub (opens in a new tab)
GHSA-qwj6-q94f-8425ModerateMathLive's Lack of Escaping of HTML allows for XSS### Summary Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the `\htmlData` command, and the lack of escaping leads to XSS. ### Details Overall in the code, other than in the `test` folder, no functions escaping HTML can be seen. ### PoC 1. Go to https://cortexjs.io/mathlive/demo/ 2. Paste either `\htmlData{><img/onerror=alert(1)"src=}{}` or `\htmlData{x=" ><img/onerror=alert(1) src>}{}` in the LaTeX textarea. ### Impact MathLive users who render untrusted mathematical expressions could encounte
  • < 0.104.0
GitHub (opens in a new tab)
  • GHSA-fm7p-gw32-828pModerate
    mathlive's Lack of Escaping of HTML allows for XSS
    • < 0.110.0
    GitHub (opens in a new tab)

    ### Summary Despite the 0.104.0 patch escaping attribute-bearing constructs (`\htmlData`, `\href`), text-content reflection was missed. The `\text{}`, `\mbox{}` commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. ### Details `Box.toMarkup` at `src/core/box.ts:356` concatenates `this.value` into the rendered span without HTML-escaping. In text mode any literal character (`<`, `>`, `&`, `"`) is wrapped into a `TextAtom` whose `value` is the raw codepoint and lands in the markup unchanged. The MathM

    CVE: CVE-2026-54705

  • GHSA-929m-phjg-qwccModerate
    Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS
    • < 0.104.0
    GitHub (opens in a new tab)

    ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references. ### Original Description Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.

  • GHSA-qwj6-q94f-8425Moderate
    MathLive's Lack of Escaping of HTML allows for XSS
    • < 0.104.0
    GitHub (opens in a new tab)

    ### Summary Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the `\htmlData` command, and the lack of escaping leads to XSS. ### Details Overall in the code, other than in the `test` folder, no functions escaping HTML can be seen. ### PoC 1. Go to https://cortexjs.io/mathlive/demo/ 2. Paste either `\htmlData{><img/onerror=alert(1)"src=}{}` or `\htmlData{x=" ><img/onerror=alert(1) src>}{}` in the LaTeX textarea. ### Impact MathLive users who render untrusted mathematical expressions could encounte

    CVE: CVE-2025-29049

Showing 1-3 of 3 vulnerabilities