KaTeX — Vulnerabilities & Security Advisories 5

KaTeX is a fast, easy-to-use JavaScript library for rendering mathematical notation on web pages and in applications. Historically, it has been susceptible to cross-site scripting (XSS) vulnerabilities due to improper input sanitization, allowing attackers to execute malicious scripts in user browsers. Remote code execution risks have also been identified through crafted mathematical expressions that could trigger memory corruption or bypass security controls. While no major public security incidents have been widely reported, the five documented CVEs primarily involve XSS flaws and input validation weaknesses. The library's focus on performance has occasionally resulted in insufficient security hardening, particularly around parsing untrusted mathematical expressions from user inputs or third-party sources.