CVE-2026-121588

The TeXlyre application (versions 0.11.0 before 0.13.5 ) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists when the application processes LSP or typesetter recipe icons . An attacker can provide a malicious icon containing an HTML event handler , which executes s...

EUVD-2026-116036

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

CVE-2026-121588: texlyre: TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute…

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...