CVE-2025-29049

Published: Apr 1, 2025Modified: Jun 17, 2026Deferred

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/advisories/GHSA-qwj6-q94f-8425

Source: cve@mitre.org

https://github.com/arnog/mathlive/commit/abc26056fd5e29a99edfa96a0bbe855ea2a8b678

Source: cve@mitre.org

https://github.com/advisories/GHSA-qwj6-q94f-8425

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.