PT-2024-22361 · Katex+3 · Katex+3

7085 · Published 2024-03-25 · Updated 2025-09-02 · CVE-2024-28246

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions KaTeX versions prior to 0.16.10

Description KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's trust option can be fooled by URLs in malicious inputs that use uppercase characters in the protocol, allowing for malicious input to generate javascript: links in the output. This issue arises because KaTeX did not normalize the protocol entry of the context object provided to a user-specified trust function, which could be a mix of lowercase and/or uppercase letters.

Recommendations Upgrade to KaTeX v0.16.10 to remove this vulnerability. As a temporary workaround, consider using an allow-list instead of block-listing protocols in your trust function. Manually lowercase context.protocol via context.protocol.toLowerCase() before attempting to check for certain protocols. Avoid use of or turn off the trust option.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-697

CWE-184

Related Identifiers

CVE-2024-28246

GHSA-3WC5-FCW2-2329

USN-7572-1

Affected Products

Debian

Katex

Linuxmint

Ubuntu

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28246.json · Exploit
• https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de · Patch
• https://osv.dev/vulnerability/CVE-2024-28246 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3wc5-fcw2-2329 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28246 · Security Note
• https://ubuntu.com/security/CVE-2024-28245 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28246 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28246 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28246 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7572-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-28246 · Security Note
• https://osv.dev/vulnerability/USN-7572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23207 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28246 · Vendor Advisory