CVE-2024-28245 - Vulnerability Details - OpenCVE

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00043.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Katex	Katex

No data.

No data.

References

Link	Providers
https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770
https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00051}`	epss `{'score': 0.00043}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-03-25T19:53:01.320Z

Updated: 2024-08-02T00:48:49.569Z

Reserved: 2024-03-07T14:33:30.036Z

Link: CVE-2024-28245

Vulnrichment

Updated: 2024-08-01T15:39:47.585Z

NVD

Status : Awaiting Analysis

Published: 2024-03-25T20:15:08.370

Modified: 2024-11-21T09:06:05.163

Link: CVE-2024-28245

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-28245", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-07T14:33:30.036Z", "datePublished": "2024-03-25T19:53:01.320Z", "dateUpdated": "2024-08-02T00:48:49.569Z"}, "containers": {"cna": {"title": "KaTeX's \\includegraphics does not escape filename", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h"}, {"name": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770", "tags": ["x_refsource_MISC"], "url": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770"}], "affected": [{"vendor": "KaTeX", "product": "KaTeX", "versions": [{"version": ">= 0.11.0, < 0.6.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-25T19:53:01.320Z"}, "descriptions": [{"lang": "en", "value": "KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability."}], "source": {"advisory": "GHSA-f98w-7cxr-ff2h", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "katex", "product": "katex", "cpes": ["cpe:2.3:a:katex:katex:0.11.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0.11.0", "status": "affected", "lessThan": "0.16.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-26T19:26:52.258854Z", "id": "CVE-2024-28245", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T15:39:52.863Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:48:49.569Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h"}, {"name": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-28245", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-26T19:26:52.258854Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:katex:katex:0.11.0:*:*:*:*:*:*:*"], "vendor": "katex", "product": "katex", "versions": [{"status": "affected", "version": "0.11.0", "lessThan": "0.16.10", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T15:39:47.585Z"}}], "cna": {"title": "KaTeX's \\includegraphics does not escape filename", "source": {"advisory": "GHSA-f98w-7cxr-ff2h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "KaTeX", "product": "KaTeX", "versions": [{"status": "affected", "version": ">= 0.11.0, < 0.6.10"}]}], "references": [{"url": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h", "name": "https://github.com/KaTeX/KaTeX/security/advisories/GHSA-f98w-7cxr-ff2h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770", "name": "https://github.com/KaTeX/KaTeX/commit/c5897fcd1f73da9612a53e6b5544f1d776e17770", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-25T19:53:01.320Z"}}}, "cveMetadata": {"cveId": "CVE-2024-28245", "state": "PUBLISHED", "dateUpdated": "2024-08-01T15:39:52.863Z", "dateReserved": "2024-03-07T14:33:30.036Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-25T19:53:01.320Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}