6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
KaTeX users who render untrusted mathematical expressions could encounter malicious input using \edef
that causes a near-infinite loop, despite setting maxExpand
to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user’s KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.
Upgrade to KaTeX v0.16.10 to remove this vulnerability.
Forbid inputs containing the substring "\\edef"
before passing them to KaTeX.
(There is no easy workaround for the auto-render extension.)
KaTeX supports an option named maxExpand
which prevents infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. However, what counted as an “expansion” is a single macro expanding to any number of tokens. The expand-and-define TeX command \edef
can be used to build up an exponential number of tokens using only a linear number of expansions according to this definition, e.g. by repeatedly doubling the previous definition. This has been corrected in KaTeX v0.16.10, where every expanded token in an \edef
counts as an expansion.
If you have any questions or comments about this advisory:
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%