https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T13:15:21.478782+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-00769 bdu:2025-00769 2026-10-04T13:15:21.597284+00:00 bdu:2025-00769 https://cve.radiocsirt.org/vuln/euvd-2026-211123 EUVD-2026-211123 2026-10-04T13:15:21.597325+00:00 EUVD-2026-211123 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23207 fkie_cve-2025-23207 2026-10-04T13:15:21.597340+00:00

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.

 https://cve.radiocsirt.org/vuln/ghsa-cg87-wmx4-v546 GHSA-cg87-wmx4-v546 — KaTeX \htmlData does not validate attribute names 2026-10-04T13:15:21.597375+00:00

Affected: npm: katex

### Impact KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML.

### Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability.

### Workarounds - Avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands. - Forbid inputs containing the substring `"\\htmlData"`. - Sanitize HTML output from KaTeX.

### Details `\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.

### For more information If you have any questions or comments about this advisory:

- Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/) - Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)

 https://cve.radiocsirt.org/vuln/rhsa-2025:2753 RHSA-2025:2753 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.19.0 release 2026-10-04T13:15:21.597410+00:00

katex: \htmlData does not validate attribute names in KaTeX

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23207 UBUNTU-CVE-2025-23207 2026-10-04T13:15:21.597430+00:00

Affected: Ubuntu:Pro:22.04:LTS: node-katex, Ubuntu:Pro:24.04:LTS: node-katex, Ubuntu:25.10: node-katex, Ubuntu:26.04:LTS: node-katex

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `"\\htmlData"` and sanitize HTML output from KaTeX.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0557 WID-SEC-W-2025-0557 — Red Hat OpenShift Dev Spaces: Schwachstelle ermöglicht Codeausführung 2026-10-04T13:15:21.597458+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Dev Spaces ausnutzen, um beliebigen Programmcode auszuführen.