https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T18:52:52.208829+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-28243 CVE-2024-28243 — KaTeX's maxExpand bypassed by \edef 2026-10-02T18:52:52.212003+00:00

Affected: KaTeX

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.

 https://vulnerability.circl.lu/vuln/usn-7572-1 USN-7572-1 — node-katex vulnerabilities 2026-10-02T18:52:52.212102+00:00

Affected: Ubuntu:Pro:22.04:LTS: node-katex, Ubuntu:Pro:24.04:LTS: node-katex

Juho Forsén discovered that KaTeX did not correctly handle certain inputs, which could lead to an infinite loop. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28243)

Tobias S. Fink discovered that KaTeX did not correctly block certain URL protocols. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28246)

It was discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)

Sean Ng discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2025-23207)