DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54705: CVE-2026-54705: DOM-Based Cross-Site Scripting in MathLive LaTeX Rendering Engine

#security #cve #cybersecurity

CVE-2026-54705: DOM-Based Cross-Site Scripting in MathLive LaTeX Rendering Engine

Vulnerability ID: CVE-2026-54705
CVSS Score: 6.3
Published: 2026-07-29

CVE-2026-54705 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability affecting the MathLive library prior to version 0.110.0. The flaw stems from a lack of proper character escaping in the rendering path for LaTeX text-mode commands such as \text{} and \mbox{}, enabling unauthenticated attackers to execute arbitrary JavaScript in the victim's browser.

TL;DR

MathLive versions < 0.110.0 fail to escape text-mode commands (like \text{} and \mbox{}), enabling DOM-based Cross-Site Scripting (XSS) when rendering untrusted LaTeX.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-116
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.3
  • Exploit Status: PoC Available
  • CISA KEV Status: Not Listed
  • Impact: DOM-based Cross-Site Scripting (XSS)

Affected Systems

  • mathlive NPM library
  • mathlive: < 0.110.0 (Fixed in: 0.110.0)

Code Analysis

Commit: 5fe1c46

fix(security): sanitize text content to prevent XSS

@@ -353,7 +353,7 @@\n...\n+function escapeText(s: string): string {\n+  return s\n+    .replace(/&/g, '&amp;')\n+    .replace(/</g, '&lt;')\n+    .replace(/>/g, '&gt;');\n+}
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade mathlive to version 0.110.0 or higher.
  • Integrate client-side sanitizers such as DOMPurify to intercept and clean MathLive generated outputs.
  • Enforce a strict Content Security Policy (CSP) blocking inline scripts and unauthorized resources.

Remediation Steps:

  1. Verify current version of mathlive package using npm list mathlive.
  2. Update dependency in package.json to 0.110.0 or higher.
  3. Audit application code for any usages of convertLatexToMarkup or raw math-static components that bind directly to innerHTML sinks.
  4. Apply DOMPurify to existing elements as an secondary defensive layer.

References

Read the full report for CVE-2026-54705 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)