CVE-2024-28243: 
JavaScript vulnerability analysis and mitigation

KaTeX, a JavaScript library for TeX math rendering on the web, was found to contain a vulnerability (CVE-2024-28243) where untrusted mathematical expressions could bypass the maxExpand setting using \edef to cause a near-infinite loop. The vulnerability was discovered and disclosed on March 24, 2024, affecting KaTeX versions from v0.10.0-beta to versions prior to v0.16.10 (GitHub Advisory).

The vulnerability stems from a flaw in how KaTeX counted macro expansions against its maxExpand limit. Previously, a single macro expanding to any number of tokens was counted as one expansion. The \edef command could be exploited to build up an exponential number of tokens using only a linear number of expansions, effectively bypassing the maxExpand protection mechanism. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

The vulnerability can be exploited as an availability attack. When rendering untrusted KaTeX input, a malicious expression could cause memory overflow, tie up the main thread, or trigger stack overflow, potentially making the site unusable for clients rendering the malicious content (GitHub Advisory).

The vulnerability can be exploited by providing malicious input containing \edef commands that create an exponential expansion of tokens. The attack requires the ability to submit mathematical expressions to a system using KaTeX for rendering (GitHub Advisory).

The vulnerability has been fixed in KaTeX version 0.16.10, which now counts every expanded token in an \edef as an expansion. For users unable to upgrade immediately, a workaround is available by forbidding inputs containing the substring "\edef" before passing them to KaTeX. However, this workaround is not easily applicable to the auto-render extension (GitHub Advisory).