katex (npm)

Fast math typesetting for the web.

Advisories

Latest version

0.19.1

Released Oct 23, 2026

License

MIT

OpenSSF Scorecard

4.5 / 10

How to fix

Upgrading to 0.18.2 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install katex@0.19.1

yarn

yarn add katex@0.19.1

pnpm

pnpm add katex@0.19.1

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-238p-pmpm-9mq7 KaTeX: Existing prototype pollution can bypass trust restrictions	Low EPSS 0.30%	`>= 0.11.0, < 0.18.2`	`0.18.2`
GHSA-238p-pmpm-9mq7 KaTeX: Existing prototype pollution can bypass trust restrictions	Low EPSS 0.30%	`>= 0.11.0, < 0.18.2`	`0.18.2`
GHSA-cg87-wmx4-v546 KaTeX \htmlData does not validate attribute names	High EPSS 0.41%	`>= 0.12.0, <= 0.16.20`	No fix yet
GHSA-cg87-wmx4-v546 KaTeX \htmlData does not validate attribute names	High EPSS 0.41%	`>= 0.12.0, < 0.16.21`	`0.16.21`
GHSA-3wc5-fcw2-2329 KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols	Medium EPSS 0.41%	`>= 0.11.0, < 0.16.10`	`0.16.10`
GHSA-f98w-7cxr-ff2h KaTeX's `\includegraphics` does not escape filename	Medium EPSS 0.41%	`>= 0.11.0, < 0.16.10`	`0.16.10`
GHSA-cvr6-37gx-v8wc KaTeX's maxExpand bypassed by Unicode sub/superscripts	Medium EPSS 2.15%	`>= 0.15.4, < 0.16.10`	`0.16.10`
GHSA-64fm-8hw2-v72w KaTeX's maxExpand bypassed by `\edef`	Medium EPSS 1.41%	`>= 0.12.0, < 0.16.10`	`0.16.10`
GHSA-64fm-8hw2-v72w KaTeX's maxExpand bypassed by `\edef`	Medium EPSS 1.41%	`>= 0.12.0, < 0.16.10`	`0.16.10`

Source: git+https://github.com/KaTeX/KaTeX.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor