GHSA-gg75-v533-34cq: TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import
TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of TeXlyre versions from 0.11.0 up to, but not including, 0.13.5 are exposed if they import an LSP or typesetter recipe containing a malicious icon.
What must an attacker do to exploit it?
The attacker must supply a recipe whose icon contains an HTML event handler and persuade a victim to import that recipe. No authentication is required of the attacker, but victim interaction is required.
What could an attacker access after successful exploitation?
The injected script can persist and access local projects and repository credentials available to the affected TeXlyre instance.