GHSA-v638-q856-grg8

MathJax Regular expression Denial of Service (ReDoS)

Source: GitHub Advisory Database (reviewed) High CVE-2023-39663

Packages

Ecosystem	Package	Affected	Fixed in
npm	mathjax	<= 2.7.9	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-39663 advisory
https://github.com/mathjax/MathJax/issues/3074 web