CVE-2024-28246CWE-184CWE-697

KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols

Medium · published March 25, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
33.7
In the wild
Unconfirmed
What it is

KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00406 · 33.7th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-697 · Incorrect Comparison
Published
2024-03-25T20:00Z
EPSS history
Timeline
  • 25 MAR 20:00Z
    KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols
    cvelistv5