CVE-2025-29049
Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- Record
CVE-2025-29049- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-9490
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- Record
EUVD-2025-9490- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-929m-phjg-qwcc
Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references.
Original Description
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- Record
GHSA-929m-phjg-qwcc- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qwj6-q94f-8425
MathLive's Lack of Escaping of HTML allows for XSS
Summary
Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command, and the lack of escaping leads to XSS.
Details
Overall in the code, other than in the test folder, no functions escaping HTML can be seen.
PoC
- Go to https://cortexjs.io/mathlive/demo/
- Paste either
\htmlData{><img/onerror=alert(1)"src=}{}or\htmlData{x=" ><img/onerror=alert(1) src>}{}in the LaTeX textarea.
Impact
MathLive users who render untrusted mathematical expressions could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.
- Record
GHSA-qwj6-q94f-8425- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79, CWE-116
- Updated
- 2026-11-02
NVD
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- Record
CVE-2025-29049- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- Record
CVE-2025-29049- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-929m-phjg-qwcc
Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references.
Original Description
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
- Record
GHSA-929m-phjg-qwcc- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-qwj6-q94f-8425
MathLive's Lack of Escaping of HTML allows for XSS
Summary
Despite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the \htmlData command, and the lack of escaping leads to XSS.
Details
Overall in the code, other than in the test folder, no functions escaping HTML can be seen.
PoC
- Go to https://cortexjs.io/mathlive/demo/
- Paste either
\htmlData{><img/onerror=alert(1)"src=}{}or\htmlData{x=" ><img/onerror=alert(1) src>}{}in the LaTeX textarea.
Impact
MathLive users who render untrusted mathematical expressions could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.
- Record
GHSA-qwj6-q94f-8425- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-116, CWE-79
- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-29049 is a medium vulnerability (CVSS 6.3) in mathlive, published January 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.63%, the 50th percentile. Fixed in mathlive 0.104.0.
References
github.com/advisories/GHSA-qwj6-q94f-8425
nvd.nist.gov/vuln/detail/CVE-2025-29049