CVE-2026-54705 Details
Description
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.
A cross-site scripting (XSS) vulnerability has been identified in MathLive, a library that provides web components for mathematical display and input. This issue affects versions of MathLive through 0.109.2. The vulnerability arises because the library fails to properly escape text-mode content in the \text{} and \mbox{} commands. As a result, arbitrary JavaScript can be executed when this content is rendered. The flaw exists in the Box.toMarkup method, which concatenates unescaped text into the output. Additionally, the MathML export process independently mishandles text-mode content, further exacerbating the issue.
Users should upgrade to MathLive version 0.110.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/arnog/mathlive/commit/5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8 | [email protected] | Source CodeVendor |
| https://github.com/arnog/mathlive/issues/3028 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MathLive | <= 0.109.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | New CVE Received | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |