PT-2026-65855 · Mathlive · Mathlive

CVE-2026-54705 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions MathLive versions prior to 0.110.0

Description MathLive fails to escape text-mode content within text{} and mbox{} commands, allowing malicious input to execute arbitrary JavaScript when rendered. This occurs because the Box.toMarkup function in src/core/box.ts concatenates values into the rendered span without HTML-escaping. Additionally, the MathML serializer in src/formats/atom-to-math-ml.ts emits raw values through the xmlEscape function, scanText function, and text-mode output. These outputs are then passed into innerHTML sinks via the public API, including the <math-span> and <math-div> components, as well as the convertLatexToMarkup and convertLatexToMathMl functions and the default identity MathfieldElement.createHTML function.

Recommendations Update MathLive to version 0.110.0.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-54705

GHSA-FM7P-GW32-828P

Affected Products

Mathlive

References · 6

• 🔥 https://github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-54705 · Security Note
• https://osv.dev/vulnerability/GHSA-fm7p-gw32-828p · Vendor Advisory
• https://github.com/arnog/mathlive · Note
• https://github.com/arnog/mathlive/issues/3028 · Note
• https://github.com/arnog/mathlive/commit/5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8 · Note