Summary
KaTeX: Existing prototype pollution can bypass trust restrictions
Workarounds
- Address any prototype-pollution vulnerability in the application or its dependencies.
delete Object.prototype.trust,delete Object.prototype.default, anddelete Object.prototype.processorbefore calling KaTeX- Do not allow untrusted input to control the renderer options object or its prototype.
- Sanitize KaTeX-generated HTML before inserting it into a document.
Details
KaTeX previously used ordinary JavaScript property access in the following contexts:
- Renderer settings could be inherited from the prototype of the options object.
- Internal
defaultandprocessorsetting metadata could be inherited fromObject.prototype. - Namespace lookup could treat inherited properties as built-in definitions.
- Namespace group restoration could preserve an inherited property as though it had been an explicitly defined value.
The fix adds own-property checks to each of these paths. Inherited properties are no longer accepted as renderer settings, setting metadata, namespace definitions, or values to be restored after a group ends.
For more information
If you have any questions or comments about this advisory:
- Open an issue or security advisory in the KaTeX repository
- Email us at [email protected]
Impact
KaTeX can act as a read-side prototype pollution gadget in applications where Object.prototype has already been polluted, or where an attacker can influence the prototype of the renderer options object. (KaTeX does not enable said prototype pollution. This advisory applies when combining KaTeX with other vulnerable software that allows for prototype pollution.)
Affected versions may treat inherited properties from Object.prototype as renderer options, internal setting metadata, or namespace entries. In particular, an inherited trust value will be treated as though the application explicitly enabled trusted rendering, rather than using the documented default of false.
With attacker-controlled mathematical expressions, this can produce links capable of user-interaction cross-site scripting or load attacker-selected external resources. Exploitation requires the consuming application to insert KaTeX output into a web page without a separate sanitizer. (KaTeX does not execute scripts merely by rendering an expression.)
Other inherited settings can alter rendering behavior or resource limits. Inherited setting metadata can affect how defaults and supplied options are processed, while inherited namespace properties can be mistaken for defined macros or other internal values.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to KaTeX v0.18.2 to remove this vulnerability.
Frequently Asked Questions
- What is CVE-2026-103923? CVE-2026-103923 is a low-severity security vulnerability in katex (npm), affecting versions >= 0.11.0, < 0.18.2. It is fixed in 0.18.2.
- Which versions of katex are affected by CVE-2026-103923? katex (npm) versions >= 0.11.0, < 0.18.2 is affected.
- Is there a fix for CVE-2026-103923? Yes. CVE-2026-103923 is fixed in 0.18.2. Upgrade to this version or later.
- Is CVE-2026-103923 exploitable, and should I be worried? Whether CVE-2026-103923 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-103923 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-103923? Upgrade
katexto 0.18.2 or later.