CVE-2025-23207 - CVE House
Back to Database
Status published Medium CVE-2025-23207

\htmlData does not validate attribute names in KaTeX

Vulnerability Description

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-23207

Credits & Attribution

No credits recorded in the NVD database.

References

More from KaTeX

View All →
CVE-2024-28246
KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols
Medium 5.5
CVE-2024-28245
KaTeX's \includegraphics does not escape filename
Medium 6.3
CVE-2024-28244
KaTeX's maxExpand bypassed by Unicode sub/superscripts
Medium 6.5
CVE-2024-28243
KaTeX's maxExpand bypassed by \edef
Medium 6.5

Affected Vendor

Affected Software

KaTeX
Vulnerable Versions:
>= 0.12.0, < 0.16.21

Timeline

Official Publish: January 17th, 2025
Last Modified: January 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-116

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact