Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a cross-site scripting (XSS) issue in the mathlive library, caused by improper handling of text content within mathematical expressions. The root cause is the failure to escape HTML-sensitive characters in user-provided input for commands like \text{} and \mbox{}. This affects both the HTML and MathML output formats.
The analysis of the patch commit 5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8 reveals the exact locations of the vulnerability. In src/core/box.ts, the Box.toMarkup method was directly embedding a box's value into the HTML output without sanitization. The fix introduces a new escapeText function to properly escape the content.
Similarly, in src/formats/atom-to-math-ml.ts, multiple functions responsible for generating MathML were found to be vulnerable. The atomToMathML and scanText functions were directly using atom values in the output. The patch applies an xmlEscape function to these values to ensure they are safe for inclusion in an XML-based format like MathML. The xmlEscape function itself was also updated to correctly handle ampersands.
During exploitation, a call to render a malicious LaTeX string would lead to a stack trace involving these functions. For instance, convertLatexToMarkup would internally call Box.toMarkup, and convertLatexToMathMl would call atomToMathML and scanText, which would then process the malicious string without proper escaping, leading to the XSS.
Box.toMarkupsrc/core/box.ts
atomToMathMLsrc/formats/atom-to-math-ml.ts
scanTextsrc/formats/atom-to-math-ml.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mathlive | npm | <= 0.109.2 | 0.110.0 |