CVE-2026-54705 in MathLive
Summary
by MITRE • 07/29/2026
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
The MathLive library presents a critical cross-site scripting vulnerability affecting versions prior to 0110.0 through improper sanitization of text-mode content within mathematical expressions. This flaw exists in the core rendering pipeline where the Box.toMarkup method in src/core/box.ts fails to properly escape content within \text{} and \mbox{} commands, creating an avenue for malicious JavaScript execution when rendered in web browsers.
The vulnerability stems from inadequate input validation and sanitization mechanisms within the xmlEscape function and related text processing methods scanText and text-mode output handlers in src/formats/atom-to-math-ml.ts. These components process LaTeX mathematical notation containing text-mode commands without proper HTML escaping, allowing attackers to inject malicious payloads that execute when the rendered mathematical expressions are displayed to end users.
The attack surface encompasses multiple conversion pathways including convertLatexToMarkup, convertLatexToMathMl, and the default MathfieldElement.createHTML method, which collectively process user-supplied LaTeX input through various output formats. When malicious input containing script tags or other HTML/JavaScript content is processed through these functions, the unescaped content becomes executable within the browser context, enabling arbitrary code execution against users who view the rendered mathematical expressions.
This vulnerability directly maps to CWE-79 Cross-Site Scripting and aligns with ATT&CK technique T1203 Exploitation for Client Execution, where adversaries leverage web application vulnerabilities to execute malicious code in user browsers. The impact extends beyond simple script injection to potentially enable full client-side compromise through persistent XSS attacks, allowing attackers to steal session cookies, perform actions on behalf of users, or redirect them to malicious sites.
Organizations utilizing MathLive components should immediately upgrade to version 0.110.0 or later where the vulnerability has been addressed through proper input sanitization and HTML escaping mechanisms. Additional mitigations include implementing Content Security Policy headers, validating all user-supplied LaTeX input server-side, and employing web application firewalls to detect and block suspicious payload patterns targeting these specific rendering functions. The fix ensures that text-mode content within mathematical expressions undergoes proper HTML escaping before being incorporated into rendered output, preventing malicious JavaScript from executing during display operations.