KA
Product
KaTeX
6
CVEs
0
On KEV
7.2
Max CVSS
1
New 30D
Severity mix
Critical 0High 1Medium 4Low 1
Watch
Add KaTeX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-23207 | 7.2 | Jan 17 | \htmlData does not validate attribute names in KaTeX Affected: >= 0.12.0, < 0.16.21 |
| CVE-2024-28244 | 6.5 | Mar 25 | KaTeX's maxExpand bypassed by Unicode sub/superscripts Affected: >= 0.15.4, < 0.16.10 |
| CVE-2024-28243 | 6.5 | Mar 25 | KaTeX's maxExpand bypassed by \edef Affected: >= 0.12.0, < 0.16.10 |
| CVE-2024-28245 | 6.1 | Mar 25 | KaTeX's \includegraphics does not escape filename Affected: >= 0.11.0, < 0.6.10 |
| CVE-2024-28246 | 5.4 | Mar 25 | KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols Affected: >= 0.11.0, < 0.16.10 |
| CVE-2026-103923 | 2.1 | Oct 1 | KaTeX: Existing prototype pollution can bypass trust restrictions Affected: >= 0.11.0, < 0.18.2 |
Showing 6