CVE-2026-54705

Deferred Deferred - Pending Action

XSS in MathLive Web Components via Unescaped Text-Mode Content

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54705

Affected Vendors & Products

Vendor	Product	Version / Range
mathlive	mathlive	to 0.110.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

MathLive versions before 0.110.0 have an input sanitization flaw where text-mode content in LaTeX commands like \text{} and \mbox{} is not properly escaped. This allows malicious input to include JavaScript code that executes when the content is rendered in a browser.

Detection Guidance

This vulnerability involves improper escaping of text-mode content in MathLive components, allowing JavaScript execution. To detect it, inspect web applications using MathLive versions prior to 0.110.0 for dynamic content rendered via MathLive components like <math-span> or <math-div>. Check for user input passed to MathLive functions such as convertLatexToMarkup or convertLatexToMathMl.

Impact Analysis

If you use a vulnerable version of MathLive, attackers could inject and execute arbitrary JavaScript when users view or interact with math content. This could lead to data theft, session hijacking, or other malicious actions depending on the context of use.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive user data. This may violate GDPR's data protection requirements or HIPAA's security rules if personal or health information is compromised through such attacks.

Mitigation Strategies

Upgrade MathLive to version 0.110.0 or later to address the vulnerability. If upgrading is not immediately possible, review and sanitize all user inputs passed to MathLive components to prevent malicious JavaScript injection. Disable or restrict MathLive components in untrusted environments until patched.

Hi! I’m here to help you understand CVE-2026-54705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70