-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the Box class's HTML generation in box.ts. The commit diff shows multiple locations where attribute values were previously concatenated directly into HTML strings without sanitization (class, id, data-* attributes). The patch introduced sanitizeAttributeName/sanitizeAttributeValue functions to address this. The Box.toMarkup method was the primary HTML generation point handling user-controlled input from LaTeX commands like \htmlData, making it the vulnerable entry point. The high confidence comes from direct evidence in the patch modifying this method's attribute handling and the vulnerability's PoC demonstrating HTML injection through DOM attributes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mathlive | npm | <= 0.103.0 | 0.104.0 |