Every CVE Search/ Get API key

CVE-2024-28245

KaTeX's \includegraphics does not escape filename

6.3 MediumFix available

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.41%Up 0.4 points since Mar 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.3

KaTeX's \includegraphics does not escape filename

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Record
CVE-2024-28245
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116
Updated
2026-11-02
EUVDEUVD-2024-0914 6.3

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Record
EUVD-2024-0914
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-f98w-7cxr-ff2h 6.3

KaTeX's `\includegraphics` does not escape filename

Impact

KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML.

Patches

Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Workarounds

  • Avoid use of or turn off the trust option, or set it to forbid \includegraphics commands.
  • Forbid inputs containing the substring "\\includegraphics".
  • Sanitize HTML output from KaTeX.

Details

\includegraphics did not properly quote its filename argument, allowing it to generate invalid or malicious HTML that runs scripts.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-f98w-7cxr-ff2h
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116
Updated
2026-11-02
NVD 6.3

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Record
CVE-2024-28245
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
OSV 6.3

KaTeX's \includegraphics does not escape filename

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Record
CVE-2024-28245
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116
Updated
2026-11-02
OSVDEBIAN-CVE-2024-28245 6.1

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Record
DEBIAN-CVE-2024-28245
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-f98w-7cxr-ff2h 6.3

KaTeX's `\includegraphics` does not escape filename

Impact

KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML.

Patches

Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Workarounds

  • Avoid use of or turn off the trust option, or set it to forbid \includegraphics commands.
  • Forbid inputs containing the substring "\\includegraphics".
  • Sanitize HTML output from KaTeX.

Details

\includegraphics did not properly quote its filename argument, allowing it to generate invalid or malicious HTML that runs scripts.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-f98w-7cxr-ff2h
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116
Updated
2026-11-02
OSVUBUNTU-CVE-2024-28245 6.3

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Record
UBUNTU-CVE-2024-28245
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1790624011 No score

TuxCare security update for katex (3 CVEs)

TuxCare rebuilt katex to address 3 CVEs. Fixed in 0.12.0-tuxcare.1.

Record
CLSA-2026-1790624011
Updated
2026-11-02
OSVUSN-7572-1 No score

node-katex vulnerabilities

Juho Forsén discovered that KaTeX did not correctly handle certain inputs, which could lead to an infinite loop. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28243)

Tobias S. Fink discovered that KaTeX did not correctly block certain URL protocols. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28246)

It was discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)

Sean Ng discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2025-23207)

Record
USN-7572-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
katex
npm
 0.11.0 up to 0.16.10
0.16.10
katex
TuxCare:npm
From an advisory covering 3 CVEs
 0.12.0-tuxcare.0 up to 0.12.0-tuxcare.1, plus listed versions
0.12.0
0.12.0-tuxcare.1
node-katex
Debian:12
 All versions, plus listed versions
0.16.10+~cs6.1.0-10.16.10+~cs6.1.0-100.16.10+~cs6.1.0-20.16.10+~cs6.1.0-30.16.10+~cs6.1.0-4
Show 6 moreShow less
0.16.10+~cs6.1.0-50.16.10+~cs6.1.0-60.16.10+~cs6.1.0-70.16.10+~cs6.1.0-80.16.10+~cs6.1.0-90.16.4+~cs6.1.0-1
 None known
node-katex
Debian:13
 before 0.16.10+~cs6.1.0-1
0.16.10+~cs6.1.0-1
node-katex
Debian:14
 before 0.16.10+~cs6.1.0-1
0.16.10+~cs6.1.0-1
node-katex
Ubuntu:Pro:22.04:LTS
 before 0.13.11+~cs6.0.0-2ubuntu0.1~esm1, plus listed versions
0.10.2+dfsg-80.10.2+dfsg-90.10.2+dfsg-100.13.11+~cs6.0.0-2
0.13.11+~cs6.0.0-2ubuntu0.1~esm1
node-katex
Ubuntu:Pro:22.04:LTS
From an advisory covering 4 CVEs
 before 0.13.11+~cs6.0.0-2ubuntu0.1~esm1, plus listed versions
0.10.2+dfsg-80.10.2+dfsg-90.10.2+dfsg-100.13.11+~cs6.0.0-2
0.13.11+~cs6.0.0-2ubuntu0.1~esm1
node-katex
Ubuntu:Pro:24.04:LTS
From an advisory covering 4 CVEs
 before 0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1, plus listed versions
0.16.4+~cs6.1.0-10.16.10+~cs6.1.0-2
0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28245 is a medium vulnerability (CVSS 6.3) in Katex, published March 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in katex 0.16.10.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open