Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS
Date: 2025-04
Affected: npm/mathlive
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-29049
CWE: CWE-116
CWE-79
CVSS: 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qwj6-q94f-8425. This link is maintained to preserve external references. ### Original Description Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.


Mitigations:

Architectural layers (MAESTRO):