{"id":"UBUNTU-CVE-2024-28244","details":"KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\\def` or `\\newcommand` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for \"Unicode (sub|super)script characters\" allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.","modified":"2025-07-16T07:47:09.786586Z","published":"2024-03-25T20:15:00Z","withdrawn":"2025-07-18T16:57:45Z","upstream":["CVE-2024-28244"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-28244"},{"type":"REPORT","url":"https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc"},{"type":"REPORT","url":"https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2024-28244"}],"affected":[{"package":{"name":"node-katex","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2"}]}],"versions":["0.16.4+~cs6.1.0-1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"fonts-katex","binary_version":"0.16.10+~cs6.1.0-2"},{"binary_name":"katex","binary_version":"0.16.10+~cs6.1.0-2"},{"binary_name":"libjs-katex","binary_version":"0.16.10+~cs6.1.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-28244.json"}},{"package":{"name":"node-katex","ecosystem":"Ubuntu:25.04","purl":"pkg:deb/ubuntu/node-katex@0.16.10+~cs6.1.0-2?arch=source&distro=plucky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.10+~cs6.1.0-2"}]}],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"fonts-katex","binary_version":"0.16.10+~cs6.1.0-2"},{"binary_name":"katex","binary_version":"0.16.10+~cs6.1.0-2"},{"binary_name":"libjs-katex","binary_version":"0.16.10+~cs6.1.0-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-28244.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}