PT-2025-1297 · Katex+3 · Katex+3

Nsysean · Published 2025-01-17 · Updated 2025-09-08 · CVE-2025-23207

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KaTeX versions prior to 0.16.21

Description The issue is related to the renderToString function in the KaTeX JavaScript library, which is used for rendering mathematical expressions. It is caused by incorrect encoding or escaping of output when handling the htmlData parameter. This could allow a remote attacker to execute arbitrary code. Users who render untrusted mathematical expressions with renderToString could encounter malicious input using htmlData that runs arbitrary JavaScript or generates invalid HTML.

Recommendations For versions prior to 0.16.21, upgrade to KaTeX v0.16.21 to remove this vulnerability. As a temporary workaround, consider turning off the trust option or setting it to forbid htmlData commands. Forbid inputs containing the substring "htmlData". Sanitize HTML output from KaTeX to minimize the risk of exploitation.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

BDU:2025-00769

CVE-2025-23207

GHSA-CG87-WMX4-V546

USN-7572-1

Affected Products

Debian

Katex

Linuxmint

Ubuntu

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23207.json · Exploit
• https://github.com/KaTeX/KaTeX/commit/ff289955e81aab89086eef09254cbf88573d415c · Patch
• https://ubuntu.com/security/CVE-2024-28243 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-23207 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-28245 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg87-wmx4-v546 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23207 · Security Note
• https://bdu.fstec.ru/vul/2025-00769 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-23207 · Security Note
• https://ubuntu.com/security/notices/USN-7572-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-23207 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-23207 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-23207 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7572-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-23207 · Vendor Advisory