Vulnerability-Lookup

ubuntu-cve-2025-23207

Vulnerability from osv_ubuntu

Published

2025-01-17 22:15

Modified

2026-05-20 15:17

Summary

Details

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the trust option, or set it to forbid \htmlData commands, forbid inputs containing the substring "\\htmlData" and sanitize HTML output from KaTeX.

Severity

6.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

7.2 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-23207	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-23207	REPORT
	https://github.com/KaTeX/KaTeX/security/advisorie…	REPORT
	https://github.com/KaTeX/KaTeX/commit/ff289955e81…	REPORT
	https://github.com/KaTeX/KaTeX/commit/ff289955e81…	REPORT
	https://ubuntu.com/security/notices/USN-7572-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.13.11+~cs6.0.0-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.2+dfsg-8",
        "0.10.2+dfsg-9",
        "0.10.2+dfsg-10",
        "0.13.11+~cs6.0.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.4+~cs6.1.0-1",
        "0.16.10+~cs6.1.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.10+~cs6.1.0-2ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.10+~cs6.1.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.10+~cs6.1.0-2ubuntu1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": []
    }
  ],
  "aliases": [],
  "details": "KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX.",
  "id": "UBUNTU-CVE-2025-23207",
  "modified": "2026-05-20T15:17:29Z",
  "published": "2025-01-17T22:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-23207"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-23207"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7572-1"
    }
  ],
  "related": [
    "USN-7572-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-23207"
  ]
}

CVE-2025-23207 (GCVE-0-2025-23207)

Vulnerability from cvelistv5 – Published: 2025-01-17 21:25 – Updated: 2025-01-17 21:32

Title

\htmlData does not validate attribute names in KaTeX

Summary

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/KaTeX/KaTeX/security/advisorie…	x_refsource_CONFIRM
https://github.com/KaTeX/KaTeX/commit/ff289955e81…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
KaTeX	KaTeX	Affected: >= 0.12.0, < 0.16.21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-23207",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-17T21:32:10.973799Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-17T21:32:24.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "KaTeX",
          "vendor": "KaTeX",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.12.0, \u003c 0.16.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\\htmlData` commands, forbid inputs containing the substring `\"\\\\htmlData\"` and sanitize HTML output from KaTeX."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-17T21:25:05.746Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cg87-wmx4-v546"
        },
        {
          "name": "https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c"
        }
      ],
      "source": {
        "advisory": "GHSA-cg87-wmx4-v546",
        "discovery": "UNKNOWN"
      },
      "title": "\\htmlData does not validate attribute names in KaTeX"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-23207",
    "datePublished": "2025-01-17T21:25:05.746Z",
    "dateReserved": "2025-01-13T17:15:41.050Z",
    "dateUpdated": "2025-01-17T21:32:24.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-7572-1

Vulnerability from osv_ubuntu

Published

2025-06-17 00:46

Modified

2026-04-27 14:11

Summary

node-katex vulnerabilities

Details

Juho Forsén discovered that KaTeX did not correctly handle certain inputs, which could lead to an infinite loop. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28243)

Tobias S. Fink discovered that KaTeX did not correctly block certain URL protocols. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28246)

It was discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)

Sean Ng discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2025-23207)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7572-1	ADVISORY
	https://ubuntu.com/security/CVE-2024-28243	REPORT
	https://ubuntu.com/security/CVE-2024-28245	REPORT
	https://ubuntu.com/security/CVE-2024-28246	REPORT
	https://ubuntu.com/security/CVE-2025-23207	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-28243",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-28245",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-28246",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-23207",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.13.11+~cs6.0.0-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.2+dfsg-8",
        "0.10.2+dfsg-9",
        "0.10.2+dfsg-10",
        "0.13.11+~cs6.0.0-2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-23207",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.4+~cs6.1.0-1",
        "0.16.10+~cs6.1.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Juho Fors\u00e9n discovered that KaTeX did not correctly handle certain\ninputs, which could lead to an infinite loop. If a user or application\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2024-28243)\n\nTobias S. Fink discovered that KaTeX did not correctly block certain\nURL protocols. If a user or system were tricked into opening a specially\ncrafted file, an attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2024-28246)\n\nIt was discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)\n\nSean Ng discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2025-23207)",
  "id": "USN-7572-1",
  "modified": "2026-04-27T14:11:43Z",
  "published": "2025-06-17T00:46:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7572-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-28243"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-28245"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-28246"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-23207"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "node-katex vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2024-28243",
    "UBUNTU-CVE-2024-28245",
    "UBUNTU-CVE-2024-28246",
    "UBUNTU-CVE-2025-23207"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2025-23207

Vulnerability from osv_ubuntu

CVE-2025-23207 (GCVE-0-2025-23207)

usn-7572-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature