Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-28246 Details

Description

KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de CVEPatch
https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329 CVEMitigationThird Party Advisory
https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de [email protected]Patch
https://github.com/KaTeX/KaTeX/security/advisories/GHSA-3wc5-fcw2-2329 [email protected]MitigationThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-184Incomplete List of Disallowed Inputs[email protected]
CWE-697Incorrect Comparison[email protected]

Affected Products

ProductVersions
katex katex
>= 0.11.0, < 0.16.10

CPE

  • cpe:2.3:a:katex:katex:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-28246
NVD Published Date:
Mar 25, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-28246 Details - Not Deferred