GHSA-cvr6-37gx-v8wc CVE-2024-28244
KaTeX's maxExpand bypassed by Unicode sub/superscripts
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 2.15%
- Chance of exploitation in the next 30 days. Higher than 82.17% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
0.16.10- Upgrade katex to this version or later
Description
Impact
KaTeX users who render untrusted mathematical expressions could encounter malicious input using \def or \newcommand that causes a near-infinite loop, despite setting maxExpand to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.
Patches
Upgrade to KaTeX v0.16.10 to remove this vulnerability.
Workarounds
Forbid inputs containing any of the characters ₊₋₌₍₎₀₁₂₃₄₅₆₇₈₉ₐₑₕᵢⱼₖₗₘₙₒₚᵣₛₜᵤᵥₓᵦᵧᵨᵩᵪ⁺⁻⁼⁽⁾⁰¹²³⁴⁵⁶⁷⁸⁹ᵃᵇᶜᵈᵉᵍʰⁱʲᵏˡᵐⁿᵒᵖʳˢᵗᵘʷˣʸᶻᵛᵝᵞᵟᵠᵡ before passing them to KaTeX.
(There is no easy workaround for the auto-render extension.)
Details
KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for "Unicode (sub|super)script characters" allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.
For more information
If you have any questions or comments about this advisory:
- Open an issue or security advisory in the KaTeX repository
- Email us at katex-security@mit.edu
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| katex | >= 0.15.4, < 0.16.10 |
0.16.10 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
katex npm → 0.16.10
- npm
npm install katex@0.16.10- yarn
yarn add katex@0.16.10- pnpm
pnpm add katex@0.16.10
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-606: Unchecked Input for Loop Condition
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
How to prevent it
- Implementation: Do not use user-controlled data for loop conditions.
- Implementation: Perform input validation.
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-238p-pmpm-9mq7 KaTeX: Existing prototype pollution can bypass trust restrictions | Low | Also affects katex |
| GHSA-cg87-wmx4-v546 KaTeX \htmlData does not validate attribute names | High | Also affects katex |
| GHSA-3wc5-fcw2-2329 KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols | Medium | Also affects katex |
| GHSA-f98w-7cxr-ff2h KaTeX's `\includegraphics` does not escape filename | Medium | Also affects katex |
| GHSA-64fm-8hw2-v72w KaTeX's maxExpand bypassed by `\edef` | Medium | Also affects katex |
| GHSA-7w5x-hrqm-74c2 smol-toml: Denial of Service via malformed TOML documents | High | Same weakness, CWE-606 |
| GHSA-m93f-wj8c-rp8p Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability | High | Same weakness, CWE-606 |
| GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS | Medium | Same weakness, CWE-606 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor