https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 14:56:51 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-00769 bdu:2025-00769 https://cve.radiocsirt.org/vuln/bdu:2025-00769 https://cve.radiocsirt.org/vuln/euvd-2026-211123 EUVD-2026-211123 https://cve.radiocsirt.org/vuln/euvd-2026-211123 https://cve.radiocsirt.org/vuln/fkie_cve-2025-23207 <p>KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `&#34;\\htmlData&#34;` and sanitize HTML output from KaTeX.</p> <p>KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `&#34;\\htmlData&#34;` and sanitize HTML output from KaTeX.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-23207 https://cve.radiocsirt.org/vuln/ghsa-cg87-wmx4-v546 <p><strong>Affected:</strong> npm: katex</p> <p>### Impact KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML.</p> <p>### Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability.</p> <p>### Workarounds - Avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands. - Forbid inputs containing the substring `&#34;\\htmlData&#34;`. - Sanitize HTML output from KaTeX.</p> <p>### Details `\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/) - Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)</p> <p><strong>Affected:</strong> npm: katex</p> <p>### Impact KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML.</p> <p>### Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability.</p> <p>### Workarounds - Avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands. - Forbid inputs containing the substring `&#34;\\htmlData&#34;`. - Sanitize HTML output from KaTeX.</p> <p>### Details `\htmlData` did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Open an issue or security advisory in the [KaTeX repository](https://github.com/KaTeX/KaTeX/) - Email us at [katex-security@mit.edu](mailto:katex-security@mit.edu)</p> https://cve.radiocsirt.org/vuln/ghsa-cg87-wmx4-v546 https://cve.radiocsirt.org/vuln/rhsa-2025:2753 <p>katex: \htmlData does not validate attribute names in KaTeX</p> <p>katex: \htmlData does not validate attribute names in KaTeX</p> https://cve.radiocsirt.org/vuln/rhsa-2025:2753 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23207 <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: node-katex, Ubuntu:Pro:24.04:LTS: node-katex, Ubuntu:25.10: node-katex, Ubuntu:26.04:LTS: node-katex</p> <p>KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `&#34;\\htmlData&#34;` and sanitize HTML output from KaTeX.</p> <p><strong>Affected:</strong> Ubuntu:Pro:22.04:LTS: node-katex, Ubuntu:Pro:24.04:LTS: node-katex, Ubuntu:25.10: node-katex, Ubuntu:26.04:LTS: node-katex</p> <p>KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToString` could encounter malicious input using `\htmlData` that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgrade to KaTeX v0.16.21 to remove this vulnerability. Users unable to upgrade should avoid use of or turn off the `trust` option, or set it to forbid `\htmlData` commands, forbid inputs containing the substring `&#34;\\htmlData&#34;` and sanitize HTML output from KaTeX.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-23207 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0557 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Dev Spaces ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat OpenShift Dev Spaces ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0557