CyberRota Analysis
AI-GeneratedMathLive versions prior to 0.110.0 are vulnerable to a cross-site scripting (XSS) attack due to improper escaping of text-mode content, which allows malicious input to execute arbitrary JavaScript when rendered. This vulnerability could lead to unauthorized actions or data exposure on web applications that utilize MathLive for math display and input. Developers and organizations using affected versions should prioritize updating to version 0.110.0 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.