CVE-2026-54705

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54705
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54705.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54705
Aliases
Published
2026-07-29T17:21:20Z
Modified
2026-08-12T03:51:46Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
mathlive's Lack of Escaping of HTML allows for XSS
Details

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, , , and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-116"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54705.json"
}
References

Affected packages

Git / github.com/arnog/mathlive

Affected ranges

Type
GIT
Repo
https://github.com/arnog/mathlive
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.110.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.24
0.27
0.27.1
v0.*
v0.0.14
v0.0.14-beta
v0.0.15
v0.0.15-beta
v0.1.0
v0.100.0
v0.101.1
v0.101.2
v0.102.0
v0.103.0
v0.104.0
v0.104.1
v0.104.2
v0.105.0
v0.105.1
v0.105.2
v0.105.3
v0.106.0
v0.107.0
v0.107.1
v0.108.0
v0.108.1
v0.108.2
v0.108.3
v0.109.0
v0.109.1
v0.109.2
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.24.1
v0.25
v0.25.0
v0.26
v0.26.0
v0.27.0
v0.27.1
v0.27.2
v0.27.3
v0.27.4
v0.28
v0.28.0
v0.29
v0.29.0
v0.29.1
v0.30
v0.31.0
v0.32
v0.32.0
v0.32.2
v0.32.9
v0.33.0
v0.33.1
v0.33.2
v0.34.0
v0.35.0
v0.35.1
v0.50.0
v0.50.1
v0.50.2
v0.50.3
v0.50.4
v0.50.5
v0.50.6
v0.50.7
v0.50.8
v0.51.0
v0.51.1
v0.52.0
v0.53.0
v0.53.1
v0.53.2
v0.53.3
v0.54.0
v0.54.1
v0.55.0
v0.56.0
v0.57
v0.57.0
v0.58
v0.58.0
v0.60.1
v0.61.0
v0.62.0
v0.63.0
v0.63.1
v0.64.0
v0.65.0
v0.66.0
v0.66.1
v0.67.0
v0.68.0
v0.69.0
v0.69.1
v0.69.10
v0.69.11
v0.69.2
v0.69.3
v0.69.4
v0.69.5
v0.69.6
v0.69.7
v0.69.8
v0.69.9
v0.70.0
v0.71.0
v0.72.0
v0.72.1
v0.72.2
v0.72.3
v0.94.0
v0.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54705.json"