CVE-2023-39663

7.5

HIGHCVSS v3

Published

August 29, 2023

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.

mathjax/MathJax

GitHubBeautiful and accessible math in all browsers

<= 2.7.9NVD

mathjax

NPMBeautiful and accessible math in all browsers. MathJax is an open-source JavaScript display engine for LaTeX, MathML, and AsciiMath notation that works in all browsers. This package includes the packaged components (install mathjax-full to get the source

<= 2.7.9NVD

@types/mathjax

More on this CVE

NVD↗GitHub Advisory↗

NPMTypeScript definitions for mathjax

<= 2.7.9NVD

MathJax

NuGet Gallery(PNG fonts are removed because they will take too long to pack/unpack.) MathJax is an open-source JavaScript display engine for LaTeX, MathML, and AsciiMath notation that works in all modern browsers. It was designed with the goal of consolidating the recent advances in web technologies into a single, definitive, math-on-the-web platform supporting the major browsers and operating systems. It requires no setup on the part of the user (no plugins to download or software to install), so the page author can write web documents that include mathematics and be confident that users will be able to view it naturally and easily. Simply include MathJax and some mathematics in a web page, and MathJax does the rest.

<= 2.7.9NVD

mathjax

Python Package IndexStub that prevents name clash with https://github.com/conda-forge/mathjax-feedstock For MathJax see https://github.com/kiwi0fruit/py-mathjax

<= 2.7.9NVD

mathjax

Crates.ioA rust interface to MathJax

<= 2.7.9NVD

Security Advisories

CVE-2023-39663

Description

More on this CVE