USN-7572-1 (UBUNTU-CVE-2024-28243)

Vulnerability from osv_ubuntu – Published: 2025-06-17 00:46 – Updated: 2026-04-27 14:11 – Source website
VLAI
Summary
node-katex vulnerabilities
Details

Juho Forsén discovered that KaTeX did not correctly handle certain inputs, which could lead to an infinite loop. If a user or application were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28243)

Tobias S. Fink discovered that KaTeX did not correctly block certain URL protocols. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28246)

It was discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)

Sean Ng discovered that KaTeX did not correctly handle certain inputs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2025-23207)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-28243",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-28245",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-28246",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-23207",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.13.11+~cs6.0.0-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.11+~cs6.0.0-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.10.2+dfsg-8",
        "0.10.2+dfsg-9",
        "0.10.2+dfsg-10",
        "0.13.11+~cs6.0.0-2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-23207",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "fonts-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          },
          {
            "binary_name": "libjs-katex",
            "binary_version": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "node-katex",
        "purl": "pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.16.10+~cs6.1.0-2ubuntu0.24.04.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.16.4+~cs6.1.0-1",
        "0.16.10+~cs6.1.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Juho Fors\u00e9n discovered that KaTeX did not correctly handle certain\ninputs, which could lead to an infinite loop. If a user or application\nwere tricked into opening a specially crafted file, an attacker could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2024-28243)\n\nTobias S. Fink discovered that KaTeX did not correctly block certain\nURL protocols. If a user or system were tricked into opening a specially\ncrafted file, an attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2024-28246)\n\nIt was discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2024-28245)\n\nSean Ng discovered that KaTeX did not correctly handle certain inputs. If\na user or system were tricked into opening a specially crafted file, an\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2025-23207)",
  "id": "USN-7572-1",
  "modified": "2026-04-27T14:11:43Z",
  "published": "2025-06-17T00:46:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7572-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-28243"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-28245"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-28246"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-23207"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "node-katex vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2024-28243",
    "UBUNTU-CVE-2024-28245",
    "UBUNTU-CVE-2024-28246",
    "UBUNTU-CVE-2025-23207"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.