Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| katex | npm | >= 0.11.0, < 0.18.2 | 0.18.2 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-103923 in KaTeX is a read-side prototype pollution issue. It arises when Object.prototype is already polluted, and KaTeX's internal mechanisms for handling renderer options, setting metadata, and namespace lookups do not properly distinguish between own properties and inherited properties. This means that properties added to Object.prototype by an attacker could be treated as legitimate configuration or data within KaTeX.
The analysis of the provided patch (commit 0adf7e77db6915d991803b29699f82b1ccf8d4f4) clearly shows the introduction of Object.prototype.hasOwnProperty.call() checks in several key areas. These checks are designed to ensure that only properties directly defined on an object (own properties) are considered, thereby preventing the use of properties inherited from the prototype chain.
Specifically, the following functions were identified as vulnerable:
Namespace.get (src/Namespace.ts): This function was vulnerable because it directly accessed this.builtins[name] without an hasOwnProperty check. If Object.prototype was polluted with a property matching name, this polluted value would be returned as a built-in definition.Namespace.restore (src/Namespace.ts): Within this method, during the restoration of namespace groups, this.current[name] was assigned to top[name] without an hasOwnProperty check on this.current. This allowed inherited properties from Object.prototype to be treated as explicitly defined values.getDefaultValue (src/Settings.ts): This function directly accessed schema.default without an hasOwnProperty check. A polluted Object.prototype.default would be incorrectly used as a default setting.applySetting (src/Settings.ts): This function was vulnerable in two ways: it directly accessed options[prop] and schema.processor without hasOwnProperty checks. This meant that polluted properties like trust or processor from Object.prototype could be interpreted as valid renderer options or setting metadata.In all these cases, the absence of hasOwnProperty checks allowed an attacker to influence KaTeX's behavior by polluting Object.prototype in the consuming application. This could lead to issues like bypassing trust restrictions (e.g., enabling trusted rendering via a polluted trust property), altering rendering behavior, or manipulating resource limits. The fix explicitly adds these checks, making the functions robust against prototype pollution.
Namespace.getsrc/Namespace.ts
Namespace.restoresrc/Namespace.ts
getDefaultValuesrc/Settings.ts
applySettingsrc/Settings.ts