CVE-2024-28246: KaTeX JavaScript Library XSS Vulnerability

CVE-2024-28246 Overview

CVE-2024-28246 affects KaTeX, a JavaScript library for TeX math rendering on the web. The vulnerability allows attackers to bypass the library's trust option URL protocol blacklist by using uppercase characters in protocol names. Applications that filter dangerous protocols such as javascript: through callbacks like trust: (context) => context.protocol !== 'javascript' can be fooled by payloads using JavaScript: or similar case variations. This results in rendered output containing executable javascript: links, enabling cross-site scripting (XSS) in affected applications. The flaw is classified under [CWE-184] (Incomplete List of Disallowed Inputs).

Critical Impact

Protocol-based security filters can be bypassed, allowing injection of javascript: URLs that execute arbitrary script in the context of applications embedding KaTeX output.

Affected Products

• KaTeX versions prior to 0.16.10
• Applications relying on KaTeX's trust option for protocol-based URL filtering
• Web applications rendering untrusted user-supplied TeX markup

Discovery Timeline

• 2024-03-25 - CVE-2024-28246 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28246

Vulnerability Analysis

KaTeX provides a trust configuration option that lets developers filter URLs in rendered math content. The trust function receives a context object containing the URL and its parsed protocol. Developers commonly reject dangerous schemes by checking context.protocol !== 'javascript'. KaTeX extracted the protocol via a regex but did not normalize the result to lowercase. An attacker supplies a URL such as JAVASCRIPT:alert(1) and the extracted protocol becomes JAVASCRIPT. The developer-supplied comparison against the lowercase string 'javascript' returns true, and the URL is treated as trusted. Browsers subsequently execute the uppercase scheme because URL protocol handling is case-insensitive.

Root Cause

The protocolFromUrl function in src/utils.js returned the raw matched protocol string without case normalization. Additionally, the regex accepted colon-like Unicode entities and lacked validation against [RFC 3986] scheme syntax. These gaps allowed malformed or mixed-case protocols to defeat exact-match blacklists.

Attack Vector

Exploitation requires an attacker to supply malicious TeX input to an application that renders it with KaTeX and configures the trust callback as a protocol blacklist. User interaction is required to click the resulting link. Once clicked, the javascript: URI executes in the victim's browser session.

// Patch excerpt from src/utils.js
// Source: https://github.com/KaTeX/KaTeX/commit/fc5af64183a3ceb9be9d1c23a275999a728593de

export const protocolFromUrl = function(url: string): string | null {
    // Check for possible leading protocol.
    // https://url.spec.whatwg.org/#url-parsing strips leading whitespace
    // (U+20) or C0 control (U+00-U+1F) characters.
    // eslint-disable-next-line no-control-regex
    const protocol = /^[\\x00-\\x20]*([^\\/#?]*?)(:|�*58|�*3a|&colon)/i
    .exec(url);
    if (!protocol) {
        return "_relative";
    }
    // Reject weird colons
    if (protocol[2] !== ":") {
        return null;
    }
    // Reject invalid characters in scheme according to
    // https://datatracker.ietf.org/doc/html/rfc3986#section-3.1
    if (!/^[a-zA-Z][a-zA-Z0-9+\-.]*$/.test(protocol[1])) {
        return null;
    }
    // Lowercase the protocol

The fix normalizes the protocol to lowercase, rejects malformed colon entities, and validates scheme characters per RFC 3986. A companion change in src/Settings.js rejects URLs whose protocol cannot be parsed instead of allowing them through.

Detection Methods for CVE-2024-28246

Indicators of Compromise

• Rendered KaTeX output containing anchor tags with href attributes beginning with case-variant schemes such as JaVaScRiPt: or JAVASCRIPT:.
• Stored user content containing TeX commands like \href or \url with uppercase or mixed-case protocol strings.
• Browser console errors or Content Security Policy (CSP) violation reports referencing inline script execution from anchor clicks.

Detection Strategies

• Perform a software composition analysis (SCA) scan of web application dependencies to identify katex versions below 0.16.10.
• Grep application source for trust: callbacks that compare context.protocol to lowercase strings without normalization.
• Review web application firewall (WAF) logs for TeX payloads containing uppercase scheme indicators adjacent to \href or \url macros.

Monitoring Recommendations

• Enable CSP reporting to capture inline script execution attempts originating from javascript: URIs in rendered pages.
• Monitor outbound navigation events from pages containing user-generated math content for unusual scheme usage.
• Track dependency manifests (package.json, package-lock.json, yarn.lock) in CI pipelines and alert on vulnerable KaTeX versions.

How to Mitigate CVE-2024-28246

Immediate Actions Required

• Upgrade KaTeX to version 0.16.10 or later across all production and development environments.
• Audit all trust option implementations and ensure protocol comparisons normalize case before matching.
• Enforce a strict Content Security Policy that disallows inline script execution and javascript: URIs as a defense-in-depth control.

Patch Information

The fix is delivered in KaTeX 0.16.10 via commit fc5af64. The patch rewrites protocolFromUrl to lowercase the returned protocol, reject malformed colon entities, and validate scheme characters per RFC 3986. See the GitHub Security Advisory GHSA-3wc5-fcw2-2329 for the full disclosure.

Workarounds

• Replace blacklist-based trust callbacks with an allowlist that explicitly permits only safe protocols such as http, https, and mailto.
• Normalize context.protocol to lowercase inside the trust callback before performing any comparison.
• Sanitize rendered HTML output using a library such as DOMPurify to strip anchors with disallowed href schemes.

# Upgrade KaTeX via npm
npm install katex@^0.16.10

# Or via yarn
yarn upgrade katex@^0.16.10

# Example safe trust callback using an allowlist
# trust: (context) => {
#   const proto = (context.protocol || '').toLowerCase();
#   return ['http', 'https', 'mailto', '_relative'].includes(proto);
# }