You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.
Patches
Upgrade to KaTeX v0.16.21 to remove this vulnerability.
Workarounds
Avoid use of or turn off the trust option, or set it to forbid \htmlData commands.
Forbid inputs containing the substring "\\htmlData".
Sanitize HTML output from KaTeX.
Details
\htmlData did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.
For more information
If you have any questions or comments about this advisory:
MathML combines multidigit numbers with sup/subscript, comma separators, and multicharacter text when outputting to DOM (#3999) (7d79e22), closes #3995
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
This PR contains the following updates:
0.16.11->0.16.21GitHub Vulnerability Alerts
CVE-2025-23207
Impact
KaTeX users who render untrusted mathematical expressions with
renderToStringcould encounter malicious input using\htmlDatathat runs arbitrary JavaScript, or generate invalid HTML.Patches
Upgrade to KaTeX v0.16.21 to remove this vulnerability.
Workarounds
trustoption, or set it to forbid\htmlDatacommands."\\htmlData".Details
\htmlDatadid not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.For more information
If you have any questions or comments about this advisory:
Release Notes
KaTeX/KaTeX (katex)
v0.16.21Compare Source
Bug Fixes
v0.16.20Compare Source
Bug Fixes
v0.16.19Compare Source
Bug Fixes
strictfunction type (#4009) (4228b4e)v0.16.18Compare Source
Bug Fixes
v0.16.17Compare Source
Bug Fixes
v0.16.16Compare Source
Features
v0.16.15Compare Source
Features
\mathsfitcommand (#3998) (2218901)v0.16.14Compare Source
Features
v0.16.13Compare Source
Bug Fixes
\vdotsand\rulesupport in text mode (#3997) (0e08352), closes #3990v0.16.12Compare Source
Features
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.