CVE-2026-54705: MathLive XSS Vulnerability

CVE-2026-54705 Overview

MathLive, a widely deployed library that provides web components for math display and input, contains a cross-site scripting (XSS) vulnerability in versions prior to 0.110.0. The library fails to escape text-mode content within \text{} and \mbox{} commands during rendering. Attackers can craft LaTeX input that executes arbitrary JavaScript when processed by convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, or the default MathfieldElement.createHTML identity function. The flaw is classified under CWE-116 (Improper Encoding or Escaping of Output). Version 0.110.0 resolves the issue.

Critical Impact
Malicious LaTeX input processed through MathLive rendering functions executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential theft, and DOM manipulation on any site embedding the vulnerable component.

Affected Products

MathLive versions prior to 0.110.0
Web applications embedding MathLive <math-span> or <math-div> custom elements
Applications calling convertLatexToMarkup or convertLatexToMathMl with untrusted input

Discovery Timeline

2026-07-29 - CVE-2026-54705 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-54705

Vulnerability Analysis

MathLive parses LaTeX source into an atom tree and renders it to HTML or MathML through the Box.toMarkup pipeline in src/core/box.ts. Text-mode atoms produced by \text{} and \mbox{} carry user-supplied string content into the DOM without HTML entity encoding. The unescaped path spans multiple output stages: xmlEscape, scanText, and the text-mode branch in src/formats/atom-to-math-ml.ts.

All public rendering entry points inherit the defect. Calls to convertLatexToMarkup and convertLatexToMathMl, along with the <math-span> and <math-div> custom elements, insert raw text-mode content directly into the resulting markup. The default MathfieldElement.createHTML implementation is an identity function, so it applies no sanitization to attacker-controlled strings.

Root Cause

The root cause is missing output encoding in Box.toMarkup. The value field of a text-mode box was concatenated into the markup string without transformation, permitting characters such as <, >, and " to break the intended text context and introduce executable markup.

Attack Vector

The attack is network-reachable and requires the victim application to render attacker-influenced LaTeX. Common scenarios include comment fields, collaborative editors, learning-management platforms, and forums that pass user LaTeX through MathLive. A payload embedded inside \text{} closes the surrounding tag and injects a <script> or event handler executed by the browser.

typescript

// Patch: src/core/box.ts
toMarkup(): string {
-    let body = this.value ?? '';
+    let body = this.value ? escapeText(this.value) : '';

    //
    // 1. Render the children
}
// Source: https://github.com/arnog/mathlive/commit/5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8

The fix routes text-mode content through escapeText before it reaches the markup string, enforcing HTML entity encoding on every code path.

Detection Methods for CVE-2026-54705

Indicators of Compromise

LaTeX submissions containing \text{} or \mbox{} with embedded angle brackets, <script> tags, or DOM event handlers such as onerror= and onclick=
Rendered pages emitting unexpected <script> nodes or inline event handlers inside MathLive output containers
Client-side errors or CSP violations originating from math-span or math-div elements

Detection Strategies

Inventory application dependencies for mathlive and flag versions below 0.110.0 via software composition analysis
Add browser-side integrity checks or MutationObservers on MathLive containers to alert on script insertion
Log and inspect stored user LaTeX for suspicious sequences involving \text{} combined with HTML control characters

Monitoring Recommendations

Deploy Content Security Policy reporting to capture inline script execution attempts within pages using MathLive
Correlate web application firewall alerts on XSS patterns with endpoints known to accept LaTeX input
Review authentication and session anomalies for users exposed to rendered content from untrusted authors

How to Mitigate CVE-2026-54705

Immediate Actions Required

Upgrade MathLive to version 0.110.0 or later across all web properties
Audit application code paths that invoke convertLatexToMarkup, convertLatexToMathMl, <math-span>, or <math-div> with user input
Enforce a strict Content Security Policy that blocks inline scripts and unsafe event handlers

Patch Information

The fix is committed in MathLive commit 5fe1c46 and shipped in release 0.110.0. Details are documented in the GitHub Security Advisory GHSA-fm7p-gw32-828p and issue #3028.

Workarounds

Override MathfieldElement.createHTML with a sanitizer such as DOMPurify to strip active content before insertion
Pre-filter LaTeX input server-side to reject \text{} and \mbox{} payloads containing HTML control characters until upgrade is complete
Isolate rendered MathLive content in a sandboxed iframe with a restrictive CSP where upgrade is deferred

bash

# Upgrade MathLive to the patched release
npm install mathlive@^0.110.0

# Verify the resolved version
npm ls mathlive