Vulnerability · Published Mar 25, 2024 · Assigned by GitHub_M

CVE-2024-28246KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols

Medium 5.5

In plain English

A medium-severity security flaw in KaTeX from KaTeX. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-katex	no fix listed	DEBIAN-CVE-2024-28246
Debian:13	node-katex	0.16.10+~cs6.1.0-1	DEBIAN-CVE-2024-28246
Debian:14	node-katex	0.16.10+~cs6.1.0-1	DEBIAN-CVE-2024-28246
npm	katex	0.16.10	GHSA-3wc5-fcw2-2329

Affected products (as reported)

Vendor	Product	Versions
KaTeX	KaTeX	>= 0.11.0, < 0.16.10

Weakness: CWE-184, CWE-697 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329 x_refsource_CONFIRM
https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de x_refsource_MISC