CVE-2025-23207

What it actually does

The vulnerability permits arbitrary JavaScript execution or malformed HTML output when untrusted input containing the \htmlData macro is processed via renderToString, bypassing intended sanitization in the KaTeX rendering pipeline.

Why it matters to the business

Organizations relying on KaTeX to display user-supplied mathematical content risk cross-site scripting attacks that can compromise user sessions, exfiltrate data, or deface rendered pages; the low EPSS and lack of known exploitation reduce immediate urgency but do not eliminate exposure for public-facing applications.

How an attack unfolds

An attacker crafts a mathematical expression embedding the \htmlData macro with JavaScript payloads, submits it to an application using renderToString on untrusted input, and achieves script execution in the victim's browser context when the expression is rendered.

How to fix it

Upgrade KaTeX to commit 923f2aa15692d06ef77051bfb018c17339ef1ab4 or later; for Ubuntu 18.04 LTS systems using the file package, apply the fixed version 1:5.32-2ubuntu0.2. Where immediate upgrade is not feasible, sanitize or reject expressions containing \htmlData before rendering.

How to confirm the fix worked

Confirm the installed KaTeX version matches or exceeds the fixed commit or package version; test rendering of sample expressions containing \htmlData to verify they no longer execute scripts or produce invalid HTML.

Typical attack path

1. Identify an application endpoint that accepts and renders mathematical expressions using KaTeX renderToString without prior sanitization.
2. Craft input containing \htmlData with embedded JavaScript or HTML-breaking sequences.
3. Submit the malicious expression to the rendering function.
4. Observe execution of injected script in the client browser or generation of invalid markup.

How to detect it

Review application logs and request payloads for occurrences of the \htmlData macro or unexpected script tags in rendered math output; inspect client-side console errors or network requests triggered during math rendering.

What your security team should do

• Prioritize upgrade of all KaTeX installations to the fixed versions listed.
• Audit code paths that invoke renderToString with external input and enforce strict input validation or sandboxing.
• Monitor vulnerability disclosures and EPSS trends for any increase in exploit activity.
• Consider replacing renderToString with safer rendering methods when processing untrusted content.