{"id":"CVE-2024-28243","aliases":["CLSA-2026-1792231998","DEBIAN-CVE-2024-28243","EUVD-2024-0839","GHSA-64fm-8hw2-v72w","UBUNTU-CVE-2024-28243","USN-7572-1"],"status":"published","title":"KaTeX's maxExpand bypassed by \\edef","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01414,"percentile":0.72933,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-606","CWE-674"],"published":"2024-03-25T19:38:18Z","modified":"2026-11-02T12:02:11Z","fixes":[{"ecosystem":"npm","package":"katex","fixed_in":["0.16.10"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"katex","fixed_in":["0.12.0-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-katex","fixed_in":["0.16.10+~cs6.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-katex","fixed_in":["0.16.10+~cs6.1.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-katex","fixed_in":["0.13.11+~cs6.0.0-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"fixed":"0.16.10"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0-tuxcare.0"},{"fixed":"0.12.0-tuxcare.3"}]}],"versions":["0.12.0","0.12.0-tuxcare.1","0.12.0-tuxcare.2"]},{"source":"osv","ecosystem":"Debian:12","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.10+~cs6.1.0-1","0.16.10+~cs6.1.0-10","0.16.10+~cs6.1.0-2","0.16.10+~cs6.1.0-3","0.16.10+~cs6.1.0-4","0.16.10+~cs6.1.0-5","0.16.10+~cs6.1.0-6","0.16.10+~cs6.1.0-7","0.16.10+~cs6.1.0-8","0.16.10+~cs6.1.0-9","0.16.4+~cs6.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-1"}]}]},{"source":"osv","ecosystem":"npm","package":"katex","ranges":[{"type":"SEMVER","events":[{"introduced":"0.12.0"},{"fixed":"0.16.10"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.11+~cs6.0.0-2ubuntu0.1~esm1"}]}],"versions":["0.10.2+dfsg-8","0.10.2+dfsg-9","0.10.2+dfsg-10","0.13.11+~cs6.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.11+~cs6.0.0-2ubuntu0.1~esm1"}]}],"versions":["0.10.2+dfsg-8","0.10.2+dfsg-9","0.10.2+dfsg-10","0.13.11+~cs6.0.0-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"}]}],"versions":["0.16.4+~cs6.1.0-1","0.16.10+~cs6.1.0-2"],"bundled":4}],"products":[{"vendor":"katex","product":"katex"}],"references":[{"url":"https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/github/advisory-database/pull/6777","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28243","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-64fm-8hw2-v72w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28243.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28243","tags":["advisory"]},{"url":"https://github.com/KaTeX/KaTeX","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-28243","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28243","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7572-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-28246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-23207","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-28243","title":"KaTeX's maxExpand bypassed by \\edef","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","status":"published","published":"2024-03-25T19:40:00.843Z","modified":"2026-02-05T15:26:36.281Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-0839","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","status":"published","published":"2024-03-25T19:40:00Z","modified":"2026-02-05T15:26:36Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:48:43.229255Z"}],"ghsa":[{"id":"GHSA-64fm-8hw2-v72w","title":"KaTeX's maxExpand bypassed by `\\edef`","description":"### Impact\nKaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.\n\n### Patches\nUpgrade to KaTeX v0.16.10 to remove this vulnerability.\n\n### Workarounds\nForbid inputs containing the substring `\"\\\\edef\"` before passing them to KaTeX.\n(There is no easy workaround for the auto-render extension.)\n\n### Details\nKaTeX supports an option named `maxExpand` which prevents infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. However, what counted as an \"expansion\" is a single macro expanding to any number of tokens. The expand-and-define TeX command `\\edef` can be used to build up an exponential number of tokens using only a linear number of expansions according to this definition, e.g. by repeatedly doubling the previous definition. This has been corrected in KaTeX v0.16.10, where every expanded token in an `\\edef` counts as an expansion.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n* Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)","status":"published","published":"2024-03-25T19:38:18Z","modified":"2026-02-05T15:26:50Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-606","CWE-674"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2024-28243","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","status":"published","published":"2024-03-25T20:15:07.95Z","modified":"2026-06-17T07:21:15.07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"CVE-2024-28243","title":"KaTeX's maxExpand bypassed by \\edef","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","status":"published","published":"2024-03-25T19:40:00.843Z","modified":"2026-10-28T02:30:57.113157557Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"DEBIAN-CVE-2024-28243","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","status":"published","published":"2024-03-25T20:15:07.95Z","modified":"2026-11-02T12:02:11.120935623Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-64fm-8hw2-v72w","title":"KaTeX's maxExpand bypassed by `\\edef`","description":"### Impact\nKaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.\n\n### Patches\nUpgrade to KaTeX v0.16.10 to remove this vulnerability.\n\n### Workarounds\nForbid inputs containing the substring `\"\\\\edef\"` before passing them to KaTeX.\n(There is no easy workaround for the auto-render extension.)\n\n### Details\nKaTeX supports an option named `maxExpand` which prevents infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. However, what counted as an \"expansion\" is a single macro expanding to any number of tokens. The expand-and-define TeX command `\\edef` can be used to build up an exponential number of tokens using only a linear number of expansions according to this definition, e.g. by repeatedly doubling the previous definition. This has been corrected in KaTeX v0.16.10, where every expanded token in an `\\edef` counts as an expansion.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n* Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)","status":"published","published":"2024-03-25T19:38:18Z","modified":"2026-02-05T16:04:19.949868Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-606","CWE-674"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"UBUNTU-CVE-2024-28243","description":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.","status":"published","published":"2024-03-25T20:15:00Z","modified":"2026-02-04T16:58:51.197945Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"CLSA-2026-1792231998","title":"TuxCare security update for katex (1 CVE)","description":"TuxCare rebuilt katex to address 1 CVE. Fixed in 0.12.0-tuxcare.3.","status":"published","published":"2026-10-17T10:13:18Z","modified":"2026-10-17T13:09:26.588487052Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"USN-7572-1","title":"node-katex vulnerabilities","description":"Juho Forsén discovered that KaTeX did not correctly handle certain\ninputs, which could lead to an infinite loop. If a user or application\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2024-28243)\n\nTobias S. Fink discovered that KaTeX did not correctly block certain\nURL protocols. If a user or system were tricked into opening a specially\ncrafted file, an attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2024-28246)\n\nIt was discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)\n\nSean Ng discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2025-23207)","status":"published","published":"2025-06-17T00:46:27Z","modified":"2026-04-27T18:03:44.012907Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}