CVE-2026-103923: KaTeX JavaScript Library XSS Vulnerability

CVE-2026-103923 Overview

KaTeX is a widely used JavaScript library for rendering TeX math expressions on the web. CVE-2026-103923 affects KaTeX versions 0.11.0 through 0.18.1 and stems from reliance on ordinary JavaScript property access when reading renderer options, the trust setting, default metadata, and namespace lookups. When Object.prototype is already polluted or an attacker controls the options object's prototype, inherited properties are treated as explicitly supplied values. Attacker-controlled math expressions can then inherit a trust: true value, enabling trusted rendering that produces links capable of cross-site scripting (XSS) or loading attacker-selected external resources. The issue is fixed in version 0.18.2.

Critical Impact
An attacker who can taint Object.prototype or supply a crafted options prototype can coerce KaTeX into trusted rendering, producing links that trigger user-interaction XSS or load attacker-chosen external resources in consuming applications.

Affected Products

KaTeX versions 0.11.0 through 0.18.1
Web applications that insert unsanitized KaTeX output into pages
Downstream libraries and frameworks bundling vulnerable KaTeX releases

Discovery Timeline

2026-10-01 - CVE-2026-103923 published to the National Vulnerability Database
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-103923

Vulnerability Analysis

The vulnerability is a prototype pollution consumption flaw [CWE-807: Reliance on Untrusted Inputs in a Security Decision]. KaTeX reads security-sensitive settings — including the trust flag that governs whether KaTeX emits active content such as \href links — using direct property access on JavaScript objects. Because JavaScript resolves property reads through the prototype chain, any property set on Object.prototype is visible as if it were an own property of the options object.

KaTeX itself does not introduce prototype pollution, and rendering an expression does not execute script on its own. The risk arises when a consuming application has an unrelated prototype pollution sink, or when attacker-controlled JSON is merged into the options object. In those conditions, a crafted math expression such as \href{javascript:...}{text} is rendered as a trusted link and inserted into the DOM.

Root Cause

KaTeX used unguarded reads like schema.default and this.builtins[name], which traverse the prototype chain. If Object.prototype.trust or Object.prototype.default is set, KaTeX treats the inherited value as an intentional caller-supplied setting and promotes rendering privileges accordingly.

Attack Vector

Exploitation requires a pre-existing prototype pollution primitive in the host application and user interaction (clicking the rendered link). The attacker submits a math expression to a feature that renders KaTeX output into the page without sanitization. The patched version introduces Object.prototype.hasOwnProperty.call() guards before trusting any value.

typescript

// src/Namespace.ts — patched lookup refuses inherited properties
get(name: string): Value | undefined {
    if (Object.prototype.hasOwnProperty.call(this.current, name)) {
        return this.current[name];
    } else if (Object.prototype.hasOwnProperty.call(this.builtins, name)) {
        return this.builtins[name];
    } else {
        return undefined;
    }
}
// Source: https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4

typescript

// src/Settings.ts — getDefaultValue now checks own-property before using schema.default
function getDefaultValue(schema: SchemaEntry<keyof SettingsOptions>): DefaultValue {
    if (Object.prototype.hasOwnProperty.call(schema, "default") &&
        schema.default !== undefined) {
        return schema.default;
    }
    const type = Array.isArray(schema.type) ? schema.type[0] : schema.type;
    // ...
}
// Source: https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4

Detection Methods for CVE-2026-103923

Indicators of Compromise

Rendered KaTeX output containing <a> elements with href values beginning with javascript:, data:, or other active-content schemes.
Unexpected outbound requests to attacker-controlled domains originating from pages that render user-supplied math.
Browser console errors or Content Security Policy (CSP) violations tied to inline script execution within KaTeX-rendered regions.

Detection Strategies

Inventory application dependencies and flag any KaTeX version earlier than 0.18.2 using software composition analysis (SCA).
Scan server-side and client-side code for prototype pollution sinks such as unsafe Object.assign, recursive merge, or JSON.parse into shared objects.
Add runtime assertions that verify Object.prototype has no unexpected enumerable properties before invoking KaTeX rendering.

Monitoring Recommendations

Log and alert on CSP violation reports originating from pages that embed KaTeX output.
Monitor web application firewall (WAF) telemetry for math payloads containing \href, \url, or javascript: substrings.
Capture DOM mutation telemetry on pages rendering user-submitted content and alert on anchor tags with dangerous href schemes.

How to Mitigate CVE-2026-103923

Immediate Actions Required

Upgrade KaTeX to version 0.18.2 or later across all applications and bundled dependencies.
Audit the consuming application for prototype pollution vulnerabilities and remediate any unsafe object merge or assignment routines.
Ensure KaTeX output is passed through a sanitizer such as DOMPurify before insertion into the DOM.

Patch Information

The fix is delivered in KaTeX Release v0.18.2 via Pull Request #4260 and tracked in GitHub Security Advisory GHSA-238p-pmpm-9mq7. The patch introduces Object.prototype.hasOwnProperty.call() guards on all security-relevant option reads.

Workarounds

Explicitly pass a complete options object with trust: false on every KaTeX render call to override inherited values.
Create the options object using Object.create(null) so it has no prototype chain.
Deploy a strict Content Security Policy that forbids javascript: URIs and inline script execution to limit XSS impact.

bash

# Upgrade KaTeX to the patched release
npm install katex@^0.18.2

# Verify installed version
npm ls katex