CVE-2024-28243 - CVE House
Back to Database
Status published Medium CVE-2024-28243

KaTeX's maxExpand bypassed by \edef

Vulnerability Description

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28243

Credits & Attribution

No credits recorded in the NVD database.

References

More from KaTeX

View All →
CVE-2025-23207
\htmlData does not validate attribute names in KaTeX
Medium 6.3
CVE-2024-28246
KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols
Medium 5.5
CVE-2024-28245
KaTeX's \includegraphics does not escape filename
Medium 6.3
CVE-2024-28244
KaTeX's maxExpand bypassed by Unicode sub/superscripts
Medium 6.5

Affected Vendor

Affected Software

KaTeX
Vulnerable Versions:
>= 0.12.0, < 0.16.10

Timeline

Official Publish: March 25th, 2024
Last Modified: February 5th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-674

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.