Every CVE Search/ Get API key

CVE-2025-23207

\htmlData does not validate attribute names in KaTeX

6.3 MediumFix available

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.41%Up 0.4 points since Jan 18, 2025
90%50%10%1%

What each source reports

CVE List Score used 6.3

\htmlData does not validate attribute names in KaTeX

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Record
CVE-2025-23207
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116
Updated
2026-11-02
EUVDEUVD-2025-0112 6.3

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Record
EUVD-2025-0112
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-cg87-wmx4-v546 6.3

KaTeX \htmlData does not validate attribute names

Impact

KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.

Patches

Upgrade to KaTeX v0.16.21 to remove this vulnerability.

Workarounds

  • Avoid use of or turn off the trust option, or set it to forbid \htmlData commands.
  • Forbid inputs containing the substring "\\htmlData".
  • Sanitize HTML output from KaTeX.

Details

\htmlData did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-cg87-wmx4-v546
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-79, CWE-116
Updated
2026-11-02
NVD 6.3

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Record
CVE-2025-23207
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-116, CWE-79
Updated
2026-11-02
OSV 6.3

\htmlData does not validate attribute names in KaTeX

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Record
CVE-2025-23207
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116
Updated
2026-11-02
OSVDEBIAN-CVE-2025-23207 7.2

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Record
DEBIAN-CVE-2025-23207
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-cg87-wmx4-v546 6.3

KaTeX \htmlData does not validate attribute names

Impact

KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.

Patches

Upgrade to KaTeX v0.16.21 to remove this vulnerability.

Workarounds

  • Avoid use of or turn off the trust option, or set it to forbid \htmlData commands.
  • Forbid inputs containing the substring "\\htmlData".
  • Sanitize HTML output from KaTeX.

Details

\htmlData did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-cg87-wmx4-v546
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-116, CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2025-23207 6.3

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Record
UBUNTU-CVE-2025-23207
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1790624011 No score

TuxCare security update for katex (3 CVEs)

TuxCare rebuilt katex to address 3 CVEs. Fixed in 0.12.0-tuxcare.1.

Record
CLSA-2026-1790624011
Updated
2026-11-02
OSVUSN-7572-1 No score

node-katex vulnerabilities

Juho Forsén discovered that KaTeX did not correctly handle certain inputs, which could lead to an infinite loop. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28243)

Tobias S. Fink discovered that KaTeX did not correctly block certain URL protocols. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28246)

It was discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)

Sean Ng discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2025-23207)

Record
USN-7572-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
katex
npm
 0.12.0 to 0.16.20
0.16.21
katex
TuxCare:npm
From an advisory covering 3 CVEs
 0.12.0-tuxcare.0 up to 0.12.0-tuxcare.1, plus listed versions
0.12.0
0.12.0-tuxcare.1
node-katex
Debian:12
 All versions, plus listed versions
0.16.10+~cs6.1.0-10.16.10+~cs6.1.0-20.16.10+~cs6.1.0-30.16.10+~cs6.1.0-40.16.10+~cs6.1.0-5
Show 5 moreShow less
0.16.10+~cs6.1.0-60.16.10+~cs6.1.0-70.16.10+~cs6.1.0-80.16.10+~cs6.1.0-90.16.4+~cs6.1.0-1
 None known
node-katex
Debian:13
 All versions, plus listed versions
0.16.10+~cs6.1.0-20.16.10+~cs6.1.0-30.16.10+~cs6.1.0-40.16.10+~cs6.1.0-50.16.10+~cs6.1.0-60.16.10+~cs6.1.0-70.16.10+~cs6.1.0-80.16.10+~cs6.1.0-9
 None known
node-katex
Debian:14
 before 0.16.10+~cs6.1.0-7, plus listed versions
0.16.10+~cs6.1.0-20.16.10+~cs6.1.0-30.16.10+~cs6.1.0-40.16.10+~cs6.1.0-50.16.10+~cs6.1.0-6
0.16.10+~cs6.1.0-7
katex
npm
 0.12.0 up to 0.16.21
0.16.21
node-katex
Ubuntu:Pro:22.04:LTS
 before 0.13.11+~cs6.0.0-2ubuntu0.1~esm1, plus listed versions
0.10.2+dfsg-80.10.2+dfsg-90.10.2+dfsg-100.13.11+~cs6.0.0-2
0.13.11+~cs6.0.0-2ubuntu0.1~esm1
node-katex
Ubuntu:Pro:24.04:LTS
 before 0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1, plus listed versions
0.16.4+~cs6.1.0-10.16.10+~cs6.1.0-2
0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1
node-katex
Ubuntu:25.10
 before 0.16.10+~cs6.1.0-2ubuntu1, plus listed versions
0.16.10+~cs6.1.0-2
0.16.10+~cs6.1.0-2ubuntu1
node-katex
Ubuntu:26.04:LTS
 before 0.16.10+~cs6.1.0-2ubuntu1
0.16.10+~cs6.1.0-2ubuntu1
node-katex
Ubuntu:Pro:22.04:LTS
From an advisory covering 4 CVEs
 before 0.13.11+~cs6.0.0-2ubuntu0.1~esm1, plus listed versions
0.10.2+dfsg-80.10.2+dfsg-90.10.2+dfsg-100.13.11+~cs6.0.0-2
0.13.11+~cs6.0.0-2ubuntu0.1~esm1
node-katex
Ubuntu:Pro:24.04:LTS
From an advisory covering 4 CVEs
 before 0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1, plus listed versions
0.16.4+~cs6.1.0-10.16.10+~cs6.1.0-2
0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23207 is a medium vulnerability (CVSS 6.3) in Katex, published January 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in katex 0.16.21.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open