AIKIDO-2026-293837

katex is vulnerable to Prototype Pollution

Prototype Pollution Pre-CVE Published Aug 10, 2026

Medium Risk

This Affects:

katex

0.11.0 - 0.18.1

Fixed in 0.18.2

Are you affected? Scan for Free

TL;DR

KaTeX reads rendering settings and macro-namespace entries using property lookups that also traverse the JavaScript prototype chain. When an application passes an untrusted option object or when Object.prototype is polluted, inherited properties can override security-sensitive settings such as trust, causing KaTeX to treat unsafe input as trusted and render javascript: URLs. This bypasses the trust controls that normally block dangerous links and commands, leading to cross-site scripting. The fix restricts settings, schema, and namespace lookups to own properties so inherited or polluted prototype values can no longer influence configuration.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application passes untrusted or externally influenced option objects to KaTeX or runs in an environment where Object.prototype can be polluted by untrusted input.