Vulnerability · Published Mar 25, 2024 · Assigned by GitHub_M

CVE-2024-28243KaTeX's maxExpand bypassed by \edef

Medium 6.5

In plain English

A medium-severity security flaw in KaTeX from KaTeX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.4%top 27.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-katex	no fix listed	DEBIAN-CVE-2024-28243
Debian:13	node-katex	0.16.10+~cs6.1.0-1	DEBIAN-CVE-2024-28243
Debian:14	node-katex	0.16.10+~cs6.1.0-1	DEBIAN-CVE-2024-28243
npm	katex	0.16.10	GHSA-64fm-8hw2-v72w

Affected products (as reported)

Vendor	Product	Versions
KaTeX	KaTeX	>= 0.12.0, < 0.16.10

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/KaTeX/KaTeX/security/advisories/GHSA-64fm-8hw2-v72w x_refsource_CONFIRM
https://github.com/github/advisory-database/pull/6777 x_refsource_MISC
https://github.com/KaTeX/KaTeX/commit/e88b4c357f978b1bca8edfe3297f0aa309bcbe34 x_refsource_MISC