PT-2024-22359 · Katex+1 · Katex+1

Jupenur · Published 2024-03-25 · Updated 2025-09-02 · CVE-2024-28244

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions KaTeX versions prior to 0.16.10

Description KaTeX is a JavaScript library for TeX math rendering on the web. Users who render untrusted mathematical expressions could encounter malicious input using def or ewcommand that causes a near-infinite loop, despite setting maxExpand to avoid such loops. KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for Unicode (sub|super)script characters allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent.

Recommendations Upgrade to KaTeX v0.16.10 to remove this vulnerability. As a temporary workaround, consider forbidding inputs containing any of the characters ₊₋₌₍₎₀₁₂₃₄₅₆₇₈₉ₐₑₕᵢⱼₖₗₘₙₒₚᵣₛₜᵤᵥₓᵦᵧᵨᵩᵪ⁺⁻⁼⁽⁾⁰¹²³⁴⁵⁶⁷⁸⁹ᵃᵇᶜᵈᵉᵍʰⁱʲᵏˡᵐⁿᵒᵖʳˢᵗᵘʷˣʸᶻᵛᵝᵞᵟᵠᵡ before passing them to KaTeX.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

CWE-606

Related Identifiers

CVE-2024-28244

GHSA-CVR6-37GX-V8WC

Affected Products

Debian

Katex

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28244.json · Exploit
• https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2 · Patch
• https://osv.dev/vulnerability/CVE-2024-28244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28244 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28244 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28244 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cvr6-37gx-v8wc · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28244 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28244 · Security Note
• https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc · Note
• https://github.com/KaTeX/KaTeX · Note
• https://t.me/cvenotify/74612 · Telegram Post
• https://twitter.com/RedPacketSec/status/1773291733691826199 · Twitter Post
• https://twitter.com/CVEnew/status/1772356856239022482 · Twitter Post