https://vulnerability.circl.lu/sightings/feed 2026-08-08T08:05:12.088866+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/39bdc50f-fae3-45f6-8045-96abfe453903/export 2026-08-08T08:05:12.112489+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "39bdc50f-fae3-45f6-8045-96abfe453903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54705", "type": "published-proof-of-concept", "source": "https://github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p", "content": "", "creation_timestamp": "2026-07-29T18:35:03.774847Z"} 2026-07-29T18:35:03.774847+00:00 https://vulnerability.circl.lu/sighting/12bd349c-ecd5-469b-855e-bfbe67e4c319/export 2026-08-08T08:05:12.115292+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "12bd349c-ecd5-469b-855e-bfbe67e4c319", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54705", "type": "seen", "source": "https://gist.github.com/alon710/1cabeec5e425623518fb342992349eb6", "content": "# CVE-2026-54705: CVE-2026-54705: DOM-Based Cross-Site Scripting in MathLive LaTeX Rendering Engine\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54705\n\n## Summary\nCVE-2026-54705 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability affecting the MathLive library prior to version 0.110.0. The flaw stems from a lack of proper character escaping in the rendering path for LaTeX text-mode commands such as \\text{} and \\mbox{}, enabling unauthenticated attackers to execute arbitrary JavaScript in the victim's browser.\n\n## TL;DR\nMathLive versions < 0.110.0 fail to escape text-mode commands (like \\text{} and \\mbox{}), enabling DOM-based Cross-Site Scripting (XSS) when rendering untrusted LaTeX.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-116\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.3\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n- **Impact**: DOM-based Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- mathlive NPM library\n- **mathlive**: < 0.110.0 (Fixed in: `0.110.0`)\n\n## Mitigation\n\n- Upgrade mathlive to version 0.110.0 or higher.\n- Integrate client-side sanitizers such as DOMPurify to intercept and clean MathLive generated outputs.\n- Enforce a strict Content Security Policy (CSP) blocking inline scripts and unauthorized resources.\n\n**Remediation Steps:**\n1. Verify current version of mathlive package using `npm list mathlive`.\n2. Update dependency in `package.json` to `0.110.0` or higher.\n3. Audit application code for any usages of `convertLatexToMarkup` or raw math-static components that bind directly to innerHTML sinks.\n4. Apply DOMPurify to existing elements as an secondary defensive layer.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p)\n- [MathLive Issue #3028](https://github.com/arnog/mathlive/issues/3028)\n- [MathLive Fix Commit](https://github.com/arnog/mathlive/commit/5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54705) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T18:31:02.031024Z"} 2026-07-29T18:31:02.031024+00:00