CVE-2025-29049 MathLive's Lack of Escaping of HTML allows for XSS
An attacker can execute arbitrary code via a Cross-Site Scripting vulnerability in the MathLive JavaScript library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-29049?
CVE-2025-29049 is a medium-severity cross-site scripting vulnerability in n/a, published on 1 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.
Weakness: CWE-79
Which versions are affected by CVE-2025-29049?
2 open source packages ship an affected version, including mathlive.
| Package | Affected | Fixed in |
|---|---|---|
mathlive npm | All versions | 0.104.0 |
mathlive npm | All versions | 0.104.0 |
How do I fix CVE-2025-29049?
Upgrade mathlive to 0.104.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-29049 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-29049 exists.
Sources
Also known as GHSA-qwj6-q94f-8425.