CVE-2026-107252: MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
Published Oct 30, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.
Event History
Oct 30, 2026
CVE Published
via MITRE·03:10 AM
Data Sourced
via MITRE·03:10 AM
DescriptionWeakness
Data Sourced
via NVD·04:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated Drupal account?
No. The vulnerability is rated with no privileges required (PR:N), so an attacker does not need to authenticate before attempting exploitation.
2
Does a user need to interact with attacker-controlled content for exploitation to succeed?
Yes. The vector includes user interaction required (UI:R), indicating that exploitation depends on a user interacting with the malicious content.
3
Can this be exploited remotely?
Yes. The attack vector is network-based (AV:N), so exploitation can be attempted over a network rather than requiring local system access.
4
Which MathJax: LaTeX for Drupal versions are affected?
The issue affects versions from 0.0.0 through 4.1.2.