CVE-2024-28245 (published 2024-03-25T20:15Z)

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/KaTeX/KaTeX
commit_details: repo_url: https://github.com/KaTeX/KaTeX
author: Erik Demaine
author_date: 2024-03-24 17:55:44-04:00
msg: fix: escape \includegraphics src and alt
repository: repo_url: https://github.com/KaTeX/KaTeX
repo_name: KaTeX/KaTeX
description: Fast math typesetting for the web.
repo_language: JavaScript
owner: KaTeX
file_changes: filename: domTree.js
change_type: ModificationType.MODIFY
diff: @@ -315,7 +315,8 @@ export class Img implements VirtualNode {
     }
 
     toMarkup(): string {
-        let markup = `<img  src='${this.src} 'alt='${this.alt}' `;
+        let markup = `<img src="${utils.escape(this.src)}"` +
+          ` alt="${utils.escape(this.alt)}"`;
 
         // Add the styles, after hyphenation
         let styles = "";
@@ -512,7 +513,7 @@ export class SvgNode implements VirtualNode {
         // Apply attributes
         for (const attr in this.attributes) {
             if (Object.prototype.hasOwnProperty.call(this.attributes, attr)) {
-                markup += ` ${attr}='${this.attributes[attr]}'`;
+                markup += ` ${attr}="${utils.escape(this.attributes[attr])}"`;
             }
         }
 
@@ -553,9 +554,9 @@ export class PathNode implements VirtualNode {
 
     toMarkup(): string {
         if (this.alternate) {
-            return `<path d='${this.alternate}'/>`;
+            return `<path d="${utils.escape(this.alternate)}"/>`;
         } else {
-            return `<path d='${path[this.pathName]}'/>`;
+            return `<path d="${utils.escape(path[this.pathName])}"/>`;
         }
     }
 }
@@ -586,7 +587,7 @@ export class LineNode implements VirtualNode {
 
         for (const attr in this.attributes) {
             if (Object.prototype.hasOwnProperty.call(this.attributes, attr)) {
-                markup += ` ${attr}='${this.attributes[attr]}'`;
+                markup += ` ${attr}="${utils.escape(this.attributes[attr])}"`;
             }
         }
 

programming_language: TypeScript
filename: katex-spec.js
change_type: ModificationType.MODIFY
diff: @@ -2096,6 +2096,18 @@ describe("An includegraphics builder", function() {
         const built = getBuilt(img, trustSettings);
         expect(built).toMatchSnapshot();
     });
+
+    it("should escape source", () => {
+        const built = katex.renderToString(
+            "\\includegraphics{'\"}", trustSettings);
+        expect(built).toContain('<img src="&#x27;&quot;"');
+    });
+
+    it("should escape alt", () => {
+        const built = katex.renderToString(
+            "\\includegraphics[alt='\"]{image.png}", trustSettings);
+        expect(built).toContain('<img src="image.png" alt="&#x27;&quot;"');
+    });
 });
 
 describe("An HTML extension builder", function() {

programming_language: TypeScript