MEDIUM5.5npm
GHSA-3wc5-fcw2-2329· CVE-2024-28246KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols
Modified: 9/10/2026
package
npm/katex
pkg:npm/katex
MEDIUM6.5npm
GHSA-64fm-8hw2-v72w· CVE-2024-28243KaTeX's maxExpand bypassed by `\edef`
Modified: 2/5/2026
MEDIUM6.3npm
GHSA-cg87-wmx4-v546· CVE-2025-23207KaTeX \htmlData does not validate attribute names
Modified: 1/21/2025
MEDIUM6.5npm
GHSA-cvr6-37gx-v8wc· CVE-2024-28244KaTeX's maxExpand bypassed by Unicode sub/superscripts
Modified: 9/10/2026
MEDIUM6.3npm
GHSA-f98w-7cxr-ff2h· CVE-2024-28245KaTeX's `\includegraphics` does not escape filename
Modified: 9/10/2026