CVE-2026-103923: 
JavaScript vulnerability analysis and mitigation

CVE-2026-103923 is a prototype pollution gadget vulnerability in KaTeX, a JavaScript library for TeX math rendering, that allows existing prototype pollution to bypass KaTeX's trust restrictions and enable cross-site scripting (XSS). Affecting KaTeX versions 0.11.0 through 0.18.1, the flaw was disclosed on October 1, 2026, and fixed in version 0.18.2 released August 8, 2026. It carries a CVSS v3.1 base score of 4.7 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, Red Hat).

The root cause is KaTeX's use of ordinary JavaScript property access (without hasOwnProperty checks) when reading renderer options, trust settings, schema defaults, processor metadata, and namespace entries — classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision) and CWE-79 (Cross-site Scripting). When Object.prototype is already polluted by another vulnerability in the application stack, or when an attacker controls the prototype of the options object passed to KaTeX, inherited properties (e.g., trust: true) are treated as explicitly configured values. This allows attacker-controlled mathematical expressions to render with trusted mode enabled, producing href links with javascript: URIs or loading attacker-selected external resources. The fix, implemented in PR #4260, adds Object.prototype.hasOwnProperty.call() checks across src/Settings.ts and src/Namespace.ts to reject inherited properties (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to inject XSS-capable links (e.g., javascript: URIs) or force loading of attacker-selected external resources into any web page that renders unsanitized KaTeX output. The impact is limited to confidentiality and integrity of the subsequent (browser) system — no direct server-side code execution occurs, and availability is unaffected. Exploitation requires user interaction (a victim must visit the affected page) and a pre-existing prototype pollution condition in the application environment (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the disclosure date (Feedly). The EPSS score is approximately 0.30%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-trivial as it requires a separate prototype pollution vulnerability to already exist in the application or its dependencies, and the consuming application must insert unsanitized KaTeX HTML output into the DOM (GitHub Advisory).

1. Identify a prototype pollution vector: Find a separate vulnerability in the target application or its npm dependencies that allows writing to Object.prototype (e.g., via a vulnerable lodash.merge, jQuery.extend, or similar utility).
2. Pollute Object.prototype.trust: Exploit the prototype pollution vulnerability to set Object.prototype.trust = true (or a function returning true) in the JavaScript runtime environment of the target application.
3. Craft a malicious KaTeX expression: Prepare a mathematical expression containing a \href{javascript:alert(document.cookie)}{click} or similar payload that KaTeX would normally block under the default trust: false setting.
4. Deliver the expression: Submit the crafted expression to the application through any input that is rendered by KaTeX (e.g., a math input field, a comment box, or a document editor).
5. Trigger victim interaction: When a victim's browser renders the page containing the unsanitized KaTeX output, the inherited trust: true causes KaTeX to emit the javascript: link. The victim clicking the link executes the attacker's script in the context of the application's origin (GitHub Advisory, Fix Commit).

• Logs: Application logs showing rendering of KaTeX expressions containing \href{javascript:...} or unusual external URLs; JavaScript error logs referencing Object.prototype property access anomalies.
• Network: Outbound requests from victim browsers to unexpected external domains triggered by KaTeX-rendered content; requests to attacker-controlled resources embedded via KaTeX \includegraphics or \href commands.
• File System / Code: Presence of prototype pollution payloads in application dependencies (e.g., vulnerable versions of lodash, jquery, hoek) alongside KaTeX versions between 0.11.0 and 0.18.1.
• Process/Runtime: JavaScript runtime evidence of Object.prototype.trust being set to a truthy value in environments running KaTeX.

The primary remediation is to upgrade KaTeX to version 0.18.2 or later, which adds hasOwnProperty checks throughout Settings.ts and Namespace.ts to prevent inherited prototype properties from being used as renderer settings (KaTeX Release). If immediate upgrade is not possible, the following workarounds apply: (1) delete Object.prototype.trust, Object.prototype.default, and Object.prototype.processor before calling KaTeX; (2) audit and remediate any prototype pollution vulnerabilities in the application's dependency tree; (3) sanitize all KaTeX-generated HTML before inserting it into the DOM using a library such as DOMPurify; and (4) do not allow untrusted input to control the KaTeX renderer options object or its prototype (GitHub Advisory).

The KaTeX maintainers (edemaine and grigoriy-reshetniak) coordinated the fix and advisory disclosure, crediting reporter joostgrunwald and remediation developer grigoriy-reshetniak (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it medium severity (Red Hat Bugzilla). The NixOS security tracker and GitLab advisory database also indexed the vulnerability shortly after disclosure, indicating broad ecosystem awareness (Feedly).