CVE-2024-28243

What it actually does

KaTeX rendering of untrusted math expressions with \edef bypasses maxExpand protections and triggers a near-infinite loop, causing memory exhaustion, main-thread blocking, or stack overflow.

Why it matters to the business

Attackers can render sites or applications using KaTeX (including Chamilo) unresponsive or crashed by submitting malicious math input, disrupting user access and availability until resources are recovered.

How an attack unfolds

An attacker supplies a crafted mathematical expression containing \edef to any web application that renders user-provided KaTeX content; the renderer enters an uncontrolled loop despite configured limits, exhausting memory or CPU and denying service to other users.

How to fix it

Upgrade KaTeX to version 0.16.10 or later. For Chamilo, apply the fix at commit 814049e5bd5317d761dda0ebbbc519cb2a64ab6c.

How to confirm the fix worked

Confirm the deployed KaTeX library reports version 0.16.10+; in Chamilo verify the presence of commit 814049e5bd5317d761dda0ebbbc519cb2a64ab6c in the relevant source tree.

Typical attack path

1. Identify a target application that accepts and renders untrusted KaTeX input (e.g., Chamilo)
2. Submit a math expression containing \edef that evades maxExpand checks
3. Renderer enters near-infinite loop, exhausting resources
4. Application or page becomes unresponsive or crashes

How to detect it

Review web application and rendering logs for repeated submissions of expressions containing \edef; correlate with spikes in CPU or memory usage on processes handling KaTeX.

• \edef
• maxExpand
• katex.js

What your security team should do

• Immediately update Chamilo to the fixed commit or a later release
• Temporarily disable or restrict user-supplied math rendering until patched
• Add input validation or rate limiting around KaTeX rendering endpoints