REDHAT-BUG-2338681: Medium severity katex vulnerability
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2338681?
The severity of REDHAT-BUG-2338681 is high due to the potential for arbitrary JavaScript execution from untrusted input.
How do I fix REDHAT-BUG-2338681?
To fix REDHAT-BUG-2338681, users should upgrade to KaTeX version 0.16.21 or later.
What impact does REDHAT-BUG-2338681 have on users?
REDHAT-BUG-2338681 can lead to security vulnerabilities through the execution of arbitrary JavaScript and invalid HTML generation.
Who is affected by REDHAT-BUG-2338681?
Users of KaTeX versions below 0.16.21 who render untrusted mathematical expressions are affected by REDHAT-BUG-2338681.
What is KaTeX and how does REDHAT-BUG-2338681 relate to it?
KaTeX is a JavaScript library for TeX math rendering, and REDHAT-BUG-2338681 highlights a security vulnerability in rendering untrusted inputs.