GHSA-v638-q856-grg8
MathJax Regular expression Denial of Service (ReDoS)
At a glance
- Published
- Updated
- CVE
- CVE-2023-39663
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.
Affected packages
| Package | Versions |
|---|---|
| npm · mathjax | introduced 0, last affected 2.7.9 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-39663 ADVISORY
- https://github.com/mathjax/MathJax/issues/3074 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |