{"id":"CVE-2025-23207","aliases":["CLSA-2026-1790624011","DEBIAN-CVE-2025-23207","EUVD-2025-0112","GHSA-cg87-wmx4-v546","UBUNTU-CVE-2025-23207","USN-7572-1"],"status":"published","title":"\\htmlData does not validate attribute names in KaTeX","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00406,"percentile":0.35367,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-79"],"published":"2025-01-17T21:22:56Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"npm","package":"katex","fixed_in":["0.16.21"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-katex","fixed_in":["0.16.10+~cs6.1.0-7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-katex","fixed_in":["0.13.11+~cs6.0.0-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-katex","fixed_in":["0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"node-katex","fixed_in":["0.16.10+~cs6.1.0-2ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"node-katex","fixed_in":["0.16.10+~cs6.1.0-2ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0"},{"last_affected":"0.16.20"},{"fixed":"0.16.21"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.0-tuxcare.0"},{"fixed":"0.12.0-tuxcare.1"}]}],"versions":["0.12.0"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.10+~cs6.1.0-1","0.16.10+~cs6.1.0-2","0.16.10+~cs6.1.0-3","0.16.10+~cs6.1.0-4","0.16.10+~cs6.1.0-5","0.16.10+~cs6.1.0-6","0.16.10+~cs6.1.0-7","0.16.10+~cs6.1.0-8","0.16.10+~cs6.1.0-9","0.16.4+~cs6.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.16.10+~cs6.1.0-2","0.16.10+~cs6.1.0-3","0.16.10+~cs6.1.0-4","0.16.10+~cs6.1.0-5","0.16.10+~cs6.1.0-6","0.16.10+~cs6.1.0-7","0.16.10+~cs6.1.0-8","0.16.10+~cs6.1.0-9"]},{"source":"osv","ecosystem":"Debian:14","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-7"}]}],"versions":["0.16.10+~cs6.1.0-2","0.16.10+~cs6.1.0-3","0.16.10+~cs6.1.0-4","0.16.10+~cs6.1.0-5","0.16.10+~cs6.1.0-6"]},{"source":"osv","ecosystem":"npm","package":"katex","ranges":[{"type":"SEMVER","events":[{"introduced":"0.12.0"},{"fixed":"0.16.21"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.11+~cs6.0.0-2ubuntu0.1~esm1"}]}],"versions":["0.10.2+dfsg-8","0.10.2+dfsg-9","0.10.2+dfsg-10","0.13.11+~cs6.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"}]}],"versions":["0.16.4+~cs6.1.0-1","0.16.10+~cs6.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2ubuntu1"}]}],"versions":["0.16.10+~cs6.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.11+~cs6.0.0-2ubuntu0.1~esm1"}]}],"versions":["0.10.2+dfsg-8","0.10.2+dfsg-9","0.10.2+dfsg-10","0.13.11+~cs6.0.0-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-katex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"}]}],"versions":["0.16.4+~cs6.1.0-1","0.16.10+~cs6.1.0-2"],"bundled":4}],"products":[{"vendor":"katex","product":"katex"}],"references":[{"url":"https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546","tags":["x_refsource_CONFIRM","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23207","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cg87-wmx4-v546"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23207.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-23207","tags":["advisory"]},{"url":"https://github.com/KaTeX/KaTeX","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-23207","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-23207","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7572-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28243","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-28245","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-28246","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-23207","title":"\\htmlData does not validate attribute names in KaTeX","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","status":"published","published":"2025-01-17T21:25:05.746Z","modified":"2025-01-17T21:32:24.984Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:32:33.410838Z"}],"euvd":[{"id":"EUVD-2025-0112","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","status":"published","published":"2025-01-17T21:25:05Z","modified":"2025-01-17T21:32:24Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:16.564106Z"}],"ghsa":[{"id":"GHSA-cg87-wmx4-v546","title":"KaTeX \\htmlData does not validate attribute names","description":"### Impact\nKaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML.\n\n### Patches\nUpgrade to KaTeX v0.16.21 to remove this vulnerability.\n\n### Workarounds\n- Avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands.\n- Forbid inputs containing the substring `\"\\\\htmlData\"`.\n- Sanitize HTML output from KaTeX.\n\n### Details\n`\\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n- Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)","status":"published","published":"2025-01-17T21:22:56Z","modified":"2025-09-10T21:03:08Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79","CWE-116"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-23207","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","status":"published","published":"2025-01-17T22:15:29.523Z","modified":"2026-06-17T08:52:38.51Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-116","CWE-79"],"updated_at":"2026-11-02T14:10:48.713733Z"}],"osv":[{"id":"CVE-2025-23207","title":"\\htmlData does not validate attribute names in KaTeX","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","status":"published","published":"2025-01-17T21:25:05.746Z","modified":"2026-10-28T02:30:59.419961454Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-23207","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","status":"published","published":"2025-01-17T22:15:29.523Z","modified":"2026-09-01T20:04:24.311649378Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"GHSA-cg87-wmx4-v546","title":"KaTeX \\htmlData does not validate attribute names","description":"### Impact\nKaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML.\n\n### Patches\nUpgrade to KaTeX v0.16.21 to remove this vulnerability.\n\n### Workarounds\n- Avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands.\n- Forbid inputs containing the substring `\"\\\\htmlData\"`.\n- Sanitize HTML output from KaTeX.\n\n### Details\n`\\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n- Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/)\n- Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)","status":"published","published":"2025-01-17T21:22:56Z","modified":"2025-01-21T18:31:02Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-116","CWE-79"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"UBUNTU-CVE-2025-23207","description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.","status":"published","published":"2025-01-17T22:15:00Z","modified":"2026-05-20T16:20:52.795998175Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2026-1790624011","title":"TuxCare security update for katex (3 CVEs)","description":"TuxCare rebuilt katex to address 3 CVEs. Fixed in 0.12.0-tuxcare.1.","status":"published","published":"2026-09-28T19:33:31Z","modified":"2026-10-15T09:48:03.995587292Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"USN-7572-1","title":"node-katex vulnerabilities","description":"Juho Forsén discovered that KaTeX did not correctly handle certain\ninputs, which could lead to an infinite loop. If a user or application\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2024-28243)\n\nTobias S. Fink discovered that KaTeX did not correctly block certain\nURL protocols. If a user or system were tricked into opening a specially\ncrafted file, an attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2024-28246)\n\nIt was discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)\n\nSean Ng discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2025-23207)","status":"published","published":"2025-06-17T00:46:27Z","modified":"2026-04-27T18:03:44.012907Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}