AIKIDO-2026-931838

drupal/mathjax is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS)CVE-2026-107252 Published Oct 8, 2026

High Risk

This Affects:

drupal/mathjax

0.0.1 - 4.1.1

Fixed in 4.1.2

Are you affected? Scan for Free

TL;DR

The MathJax module renders LaTeX on a Drupal site by loading the MathJax library from a CDN or a local copy. Affected versions ship library configurations that omit MathJax Safe mode, so JavaScript inside the TeX being formatted is not escaped. Content rendered by the module can therefore run script in the browser of anyone who views the page. The fix adds the Safe configuration to the default CDN and local library URLs, updates existing CDN URLs to include it, and warns on the status report when a custom configuration still leaves Safe mode disabled.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and MathJax Safe mode is not enabled.

Background info

drupal/mathjax is vulnerable to Cross-site Scripting (XSS) in versions 0.0.1 - 4.1.1.

How to fix this

Upgrade the drupal/mathjax library to the patch version. If the status report still warns that safe mode is not enabled, add Safe mode to the CDN URL or custom MathJax configuration.

High Risk