VYPR
← All advisories
Medium severity6.3NVD Advisory· Published Mar 25, 2024· Updated Jun 17, 2026

CVE-2024-28245

CVE-2024-28245

Description

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
katexnpm
>= 0.11.0, < 0.16.100.16.10

Affected products

3
  • KaTeX/KaTeX2 versions
    cpe:2.3:a:katex:katex:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:katex:katex:*:*:*:*:*:*:*:*range: >=0.11.0,<0.16.10
    • (no CPE)range: >= 0.11.0, < 0.6.10
  • ghsa-coords
    pkg:npm/katex
    Range: >= 0.11.0, < 0.16.10

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.