-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped filename/alt attributes in HTML image generation. The commit shows the Img.toMarkup method was modified to add utils.escape() calls for src/alt attributes. The original vulnerable code used template literals without escaping: <img src='${this.src}' alt='${this.alt}'. This directly matches the vulnerability description about improper output escaping in \includegraphics. The test cases added also specifically target src/alt attribute escaping validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| katex | npm | >= 0.11.0, < 0.16.10 | 0.16.10 |