Skip to content
KKaTeX
Products
| Product | CVEs | Exploited | Latest |
|---|
| KaTeX | 6 | – | Oct 1, 2026 |
Exploited and recent CVEs
-
CVE-2026-103923
Low 2.1
KaTeX: Existing prototype pollution can bypass trust restrictions
0.3%
-
CVE-2025-23207
Medium 6.3
\htmlData does not validate attribute names in KaTeX
0.4%
-
CVE-2024-28246
Medium 5.5
KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols
0.4%
-
CVE-2024-28245
Medium 6.3
KaTeX's \includegraphics does not escape filename
0.4%
-
CVE-2024-28244
Medium 6.5
KaTeX's maxExpand bypassed by Unicode sub/superscripts
2.2%
-
CVE-2024-28243
Medium 6.5
KaTeX's maxExpand bypassed by \edef
1.4%