GHSA-64fm-8hw2-v72w CVE-2024-28243
KaTeX's maxExpand bypassed by `\edef`
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.41%
- Chance of exploitation in the next 30 days. Higher than 72.75% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
0.16.10- Upgrade katex to this version or later
Description
Impact
KaTeX users who render untrusted mathematical expressions could encounter malicious input using \edef that causes a near-infinite loop, despite setting maxExpand to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.
Patches
Upgrade to KaTeX v0.16.10 to remove this vulnerability.
Workarounds
Forbid inputs containing the substring "\\edef" before passing them to KaTeX.
(There is no easy workaround for the auto-render extension.)
Details
KaTeX supports an option named maxExpand which prevents infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. However, what counted as an "expansion" is a single macro expanding to any number of tokens. The expand-and-define TeX command \edef can be used to build up an exponential number of tokens using only a linear number of expansions according to this definition, e.g. by repeatedly doubling the previous definition. This has been corrected in KaTeX v0.16.10, where every expanded token in an \edef counts as an expansion.
For more information
If you have any questions or comments about this advisory:
- Open an issue or security advisory in the KaTeX repository
- Email us at katex-security@mit.edu
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
katex npm → 0.16.10
- npm
npm install katex@0.16.10- yarn
yarn add katex@0.16.10- pnpm
pnpm add katex@0.16.10
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-606: Unchecked Input for Loop Condition
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
How to prevent it
- Implementation: Do not use user-controlled data for loop conditions.
- Implementation: Perform input validation.
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Advisories
Fixes and patches
Packages
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-238p-pmpm-9mq7 KaTeX: Existing prototype pollution can bypass trust restrictions | Low | Also affects katex |
| GHSA-cg87-wmx4-v546 KaTeX \htmlData does not validate attribute names | High | Also affects katex |
| GHSA-3wc5-fcw2-2329 KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols | Medium | Also affects katex |
| GHSA-f98w-7cxr-ff2h KaTeX's `\includegraphics` does not escape filename | Medium | Also affects katex |
| GHSA-cvr6-37gx-v8wc KaTeX's maxExpand bypassed by Unicode sub/superscripts | Medium | Also affects katex |
| GHSA-7w5x-hrqm-74c2 smol-toml: Denial of Service via malformed TOML documents | High | Same weakness, CWE-606 |
| GHSA-m93f-wj8c-rp8p Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability | High | Same weakness, CWE-606 |
| GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS | Medium | Same weakness, CWE-606 |
Credits: Wenxin-Jiang, edemaine, jupenur
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor