Vulnerability · Published Aug 29, 2023 · Assigned by mitre
CVE-2023-39663
High 7.5
In plain English
A high-severity security flaw in the mathjax package (Ubuntu). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.8%top 42.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | mathjax | no fix listed | UBUNTU-CVE-2023-39663 |
| npm | mathjax | no fix listed | GHSA-v638-q856-grg8 |