CVE-2024-28245: Vulnerability in katex package - Unescaped Filename in \includegraphics
Summary
CVE-2024-28245: KaTeX's \includegraphics does not escape filename. Affects katex versions >= 0.11.0, < 0.16.10. Fixed in 0.16.10. How to fix ↓
Also tracked for
- node-katex · Debian:11
The same CVE-2024-28245 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The katex package is an open-source library used for rendering mathematical expressions in web applications. It provides a fast and efficient way to display complex mathematical formulas on web pages. However, a vulnerability has been discovered in versions prior to 0.16.10 that allows for the inclusion of unescaped filenames in the \includegraphics command, potentially leading to the execution of arbitrary JavaScript or the generation of invalid HTML.
Vulnerability Detail
The vulnerability arises from the improper quoting of filenames in the \includegraphics command of the katex package. This allows an attacker to inject malicious input that can execute arbitrary JavaScript or generate invalid HTML. Users who render untrusted mathematical expressions using katex are at risk of encountering this vulnerability. The impact could range from the execution of malicious scripts to the generation of invalid HTML, which may disrupt the functionality of the web application or compromise user security.
How To Fix
Latest published version: 0.19.0 as of 22 Oct 2026
npm install katex@0.19.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.16.10
This is the first release that contains the fix.
npm install katex@0.16.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, there are a few workarounds that can mitigate the risk:
- Avoid using or disable the 'trust' option, or set it to forbid the \includegraphics command.
- Implement input validation to forbid any inputs containing the substring '\includegraphics'.
- Sanitize the HTML output from katex to remove any potentially malicious or invalid content.
Conclusion
The vulnerability in the katex package allows for the inclusion of unescaped filenames in the \includegraphics command, which can lead to the execution of arbitrary JavaScript or the generation of invalid HTML. To mitigate this risk, it is recommended to upgrade to version 0.16.10 or later of the katex package. If upgrading is not possible, implementing the provided workarounds and ensuring input validation and HTML sanitization can help reduce the vulnerability's impact. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for katex →
FAQ
The vulnerability allows for the execution of arbitrary JavaScript or the generation of invalid HTML. This can lead to the compromise of user security or the disruption of web application functionality.
Upgrading to version 0.16.10 or later of the katex package removes the vulnerability. Ensure that you are using the latest version of the package in your application.
Yes, if upgrading is not possible, you can disable the 'trust' option or implement input validation to forbid the \includegraphics command. Additionally, sanitizing the HTML output from katex can help mitigate the risk.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to promptly address and fix the vulnerability to prevent any potential exploitation.
For more information, you can visit the KaTeX repository on GitHub or contact the KaTeX team at katex-security@mit.edu.
References
Related vulnerabilities
Recent vulnerabilities recorded for katex.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
