CVE-2024-28246: KaTeX Missing Normalization of Protocol in URLs Vulnerability

katex Updated 02 Oct 2025

Summary

25/03/2024

Disclosed on

CVE-2024-28246

CVE

Yes i

Fix available

Moderate

Severity

5.5

CVSS Score

CVE-2024-28246: KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols. Affects katex versions >= 0.11.0, < 0.16.10. Fixed in 0.16.10. How to fix ↓

Also tracked for

node-katex · Debian:11

The same CVE-2024-28246 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM Drag & drop your file here or Browse Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX Upload a supported dependency manifest or SBOM. No installation or source-code access required. See supported files and SBOM formats SBOM sbom.json \cdot bom.json \cdot bom.xml \cdot *.spdx.json \cdot *.cdx.json \cdot *.cdx.xml Java pom.xml \cdot gradle.lockfile \cdot buildscript-gradle.lockfile Javascript package-lock.json \cdot yarn.lock \cdot pnpm-lock.yaml PHP composer.lock Python poetry.lock \cdot requirements.txt \cdot Pipfile.lock Go go.mod Rust Cargo.lock Ruby Gemfile.lock Dart pubspec.lock C/C++ conan.lock Elixir mix.lock Enter your work email to receive your report link. Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required. A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions .

Background

KaTeX is an open-source JavaScript library that enables the rendering of mathematical expressions on web pages. It provides a fast and efficient way to display mathematical equations using TeX syntax. The library is widely used in various web applications and websites to enhance the presentation of mathematical content. However, a vulnerability has been discovered in KaTeX that allows for the bypassing of forbidden protocols in URLs.

Vulnerability Detail

The vulnerability in KaTeX arises from the lack of normalization of the protocol in URLs. When using KaTeX's trust option, which allows for blocking certain URL protocols, malicious inputs can exploit this vulnerability by using uppercase characters in the protocol. This can lead to the generation of javascript: links in the output, even if the trust function attempts to forbid this protocol. The issue occurs because KaTeX does not normalize the protocol entry of the context object provided to the trust function, allowing for a mix of lowercase and uppercase letters. This can potentially enable attackers to execute arbitrary JavaScript code on the affected web page, leading to various security risks.

How To Fix

Latest published version: 0.19.0 as of 22 Oct 2026

npm install katex@0.19.0

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

0.16.10

This is the first release that contains the fix.

npm install katex@0.16.10

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If upgrading to the latest version of KaTeX is not immediately feasible, there are a few workarounds that can be implemented. One approach is to allow-list protocols instead of block-listing them in the trust function. Another workaround is to manually lowercase the context.protocol value by using context.protocol.toLowerCase() before checking for certain protocols. Additionally, disabling or avoiding the use of the trust option can also mitigate the vulnerability.

Conclusion

In conclusion, the vulnerability in KaTeX that allows for the bypassing of forbidden protocols in URLs can be mitigated by upgrading to the latest version of the library. Alternatively, implementing the suggested workarounds can also help in addressing the issue. It is important to take prompt action to ensure the security of web applications and prevent potential exploitation of this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for katex →

FAQ

What is KaTeX?

KaTeX is an open-source JavaScript library used for rendering mathematical expressions on web pages. It provides a fast and efficient way to display mathematical equations using TeX syntax.

What is the impact of this vulnerability?

The vulnerability allows for the bypassing of forbidden protocols in URLs, potentially leading to the generation of javascript: links in the output. This can enable attackers to execute arbitrary JavaScript code on the affected web page, posing various security risks.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade to KaTeX version 0.16.10 or later. This version includes the necessary changes to normalize the protocol in URLs and prevent the bypassing of forbidden protocols.

Are there any workarounds available?

If upgrading to the latest version of KaTeX is not immediately feasible, you can implement workarounds such as allow-listing protocols instead of block-listing them in the trust function, manually lowercasing the context.protocol value, or disabling the trust option.