CVE-2026-54705: mathlive's Lack of Escaping of HTML allows for XSS

July 29, 2026

Despite the 0.104.0 patch escaping attribute-bearing constructs (\htmlData, \href), text-content reflection was missed. The \text{}, \mbox{} commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS.

References

github.com/advisories/GHSA-fm7p-gw32-828p
github.com/arnog/mathlive/commit/5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8
github.com/arnog/mathlive/issues/3028
github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p
nvd.nist.gov/vuln/detail/CVE-2026-54705

Code Behaviors & Features

Detect and mitigate CVE-2026-54705 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →