{"id":"CVE-2025-29049","aliases":["EUVD-2025-9490","GHSA-929m-phjg-qwcc","GHSA-qwj6-q94f-8425"],"status":"published","title":"Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS","description":"Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00627,"percentile":0.5052,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-79"],"published":"2025-01-21T21:17:52Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"npm","package":"mathlive","fixed_in":["0.104.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"mathlive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.103.0"},{"fixed":"0.104.0"}]}]},{"source":"osv","ecosystem":"npm","package":"mathlive","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.104.0"}]}]}],"references":[{"url":"https://github.com/advisories/GHSA-qwj6-q94f-8425","tags":["exploit","advisory"]},{"url":"https://github.com/arnog/mathlive/commit/abc26056fd5e29a99edfa96a0bbe855ea2a8b678","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29049","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-929m-phjg-qwcc"},{"url":"https://github.com/arnog/mathlive/security/advisories/GHSA-qwj6-q94f-8425","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29049.json","tags":["advisory"]},{"url":"https://github.com/arnog/mathlive","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-29049","description":"Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","status":"published","published":"2025-04-01T00:00:00Z","modified":"2025-04-01T20:49:01.248Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:45.797843Z"}],"euvd":[{"id":"EUVD-2025-9490","description":"Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","status":"published","published":"2025-04-01T00:00:00Z","modified":"2025-04-01T20:49:01Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:45.339497Z"}],"ghsa":[{"id":"GHSA-929m-phjg-qwcc","title":"Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references.\n\n### Original Description\nCross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","status":"withdrawn","published":"2025-04-01T21:31:30Z","modified":"2025-04-02T00:33:16Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:37.325334Z"},{"id":"GHSA-qwj6-q94f-8425","title":"MathLive's Lack of Escaping of HTML allows for XSS","description":"### Summary\nDespite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the `\\htmlData` command, and the lack of escaping leads to XSS.\n\n### Details\nOverall in the code, other than in the `test` folder, no functions escaping HTML can be seen.\n\n### PoC\n1. Go to https://cortexjs.io/mathlive/demo/\n2. Paste either `\\htmlData{\u003e\u003cimg/onerror=alert(1)\"src=}{}` or `\\htmlData{x=\" \u003e\u003cimg/onerror=alert(1) src\u003e}{}` in the LaTeX textarea.\n\n### Impact\nMathLive users who render untrusted mathematical expressions could encounter malicious input using \\htmlData that runs arbitrary JavaScript, or generate invalid HTML.","status":"published","published":"2025-01-21T21:17:52Z","modified":"2025-04-02T00:33:43Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79","CWE-116"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2025-29049","description":"Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","status":"published","published":"2025-04-01T21:15:43.82Z","modified":"2026-06-17T09:05:05.683Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"CVE-2025-29049","description":"Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","status":"published","published":"2025-04-01T00:00:00Z","modified":"2026-10-28T02:30:32.821016802Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-929m-phjg-qwcc","title":"Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references.\n\n### Original Description\nCross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.","status":"withdrawn","published":"2025-04-01T21:31:30Z","modified":"2025-04-02T00:33:15Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"GHSA-qwj6-q94f-8425","title":"MathLive's Lack of Escaping of HTML allows for XSS","description":"### Summary\nDespite normal text rendering as LaTeX expressions, preventing XSS, the library also provides users with commands which may modify HTML, such as the `\\htmlData` command, and the lack of escaping leads to XSS.\n\n### Details\nOverall in the code, other than in the `test` folder, no functions escaping HTML can be seen.\n\n### PoC\n1. Go to https://cortexjs.io/mathlive/demo/\n2. Paste either `\\htmlData{\u003e\u003cimg/onerror=alert(1)\"src=}{}` or `\\htmlData{x=\" \u003e\u003cimg/onerror=alert(1) src\u003e}{}` in the LaTeX textarea.\n\n### Impact\nMathLive users who render untrusted mathematical expressions could encounter malicious input using \\htmlData that runs arbitrary JavaScript, or generate invalid HTML.","status":"published","published":"2025-01-21T21:17:52Z","modified":"2026-07-08T07:27:38.159109127Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-116","CWE-79"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}