CLSA-2026-1791284260 TuxCare security update for katex (1 CVE)

TuxCare rebuilt katex to address 1 CVE. Fixed in 0.12.0-tuxcare.2...

PT-2026-115954

TuxCare rebuilt katex to address 1 CVE. Fixed in 0.12.0-tuxcare.2...

3d-emoji (>=2.1.0, <=2.3.0), 5g-fe-components (>=1.0.6, <=1.1.0) +9183 more potentially affected by CVE-2026-103923 via katex (>=0.11.0, <=0.18.1)

katex NPM version =0.11.0, =2.1.0, =1.0.6, =1.0.0, =0.0.6, =0.0.0-develop-20260120180031, =0.1.16, =0.1.0, =0.0.1-alpha.7, =0.0.3-alpha.37, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.1, =0.1.0, =0.12.0 and more Source cves: CVE-2026-103923 Source advisory: OSV:GHSA-238P-PMPM-9MQ7...

EUVD-2026-90979

KaTeX: Existing prototype pollution can bypass trust restrictions...

3d-emoji (>=2.1.0, <=2.3.0), 5g-fe-components (>=1.0.6, <=1.1.0) +9183 more potentially affected by CVE-2026-103923 via katex (>=0.11.0, <=0.18.1)

katex NPM version =0.11.0, =2.1.0, =1.0.6, =1.0.0, =0.0.6, =0.0.0-develop-20260120180031, =0.1.16, =0.1.0, =0.0.1-alpha.7, =0.0.3-alpha.37, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.1, =0.1.0, =0.12.0 and more Source cves: CVE-2026-103923 Source advisory: GHSA-238P-PMPM-9MQ7...

NPM: KaTeX: Existing prototype pollution can bypass trust restrictions

NPM: KaTeX: Existing prototype pollution can bypass trust restrictions vulnerability discovered by ? in WordPress Npm katex versions = 0.11.0, 0.18.2...

GHSA-238P-PMPM-9MQ7 KaTeX: Existing prototype pollution can bypass trust restrictions

Impact KaTeX can act as a read-side prototype pollution gadget in applications where Object.prototype has already been polluted, or where an attacker can influence the prototype of the renderer options object. KaTeX does not enable said prototype pollution. This advisory applies when combining...

KaTeX: Existing prototype pollution can bypass trust restrictions

Impact KaTeX can act as a read-side prototype pollution gadget in applications where Object.prototype has already been polluted, or where an attacker can influence the prototype of the renderer options object. KaTeX does not enable said prototype pollution. This advisory applies when combining...

SUSE CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923

A flaw was found in KaTeX. When JavaScript prototype pollution is present or an attacker can manipulate configuration prototypes, KaTeX improperly relies on inherited properties instead of strictly validated configuration options. A remote attacker submitting crafted mathematical expressions can...

Linux Distros Unpatched Vulnerability : CVE-2026-103923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for...

3d-emoji (>=2.1.0, <=2.3.0), 5g-fe-components (>=1.0.6, <=1.1.0) +9183 more potentially affected by CVE-2026-103923 via katex (>=0.11.0, <=0.18.1)

katex NPM version =0.11.0, =2.1.0, =1.0.6, =1.0.0, =0.0.6, =0.0.0-develop-20260120180031, =0.1.16, =0.1.0, =0.0.1-alpha.7, =0.0.3-alpha.37, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.1, =0.1.0, =0.12.0 and more Source cves: CVE-2026-103923 Source advisory: SNYK:JS-KATEX-20419402...

Reliance on Untrusted Inputs in a Security Decision

Overview katex is a Fast math typesetting for the web. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the applySetting function in src/Settings.ts and the get/set methods in src/Namespace.ts, where user-controlled option keys and macro...

DEBIAN-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

3d-emoji (>=2.1.0, <=2.3.0), 5g-fe-components (>=1.0.6, <=1.1.0) +9183 more potentially affected by CVE-2026-103923 via katex (>=0.11.0, <=0.18.1)

katex NPM version =0.11.0, =2.1.0, =1.0.6, =1.0.0, =0.0.6, =0.0.0-develop-20260120180031, =0.1.16, =0.1.0, =0.0.1-alpha.7, =0.0.3-alpha.37, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.1, =0.1.0, =0.12.0 and more Source cves: CVE-2026-103923 Source advisory: MEND:CVE-2026-103923...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...