Cross-Site Scripting Vulnerability in MathJax: LaTeX for Drupal by Drupal
CVE-2026-107252

Currently unrated

Key Information:

Vendor

Drupal
Status
Mathjax: Latex For Drupal
Vendor
CVE Published:
30 October 2026

What is CVE-2026-107252?

A Cross-Site Scripting (XSS) vulnerability has been identified in MathJax: LaTeX for Drupal. This flaw arises due to improper handling of input during web page generation, potentially allowing attackers to inject malicious scripts. Affected versions range from 0.0.0 to 4.1.2, posing a risk to data integrity and security for users. It's crucial for site administrators to update affected installations to mitigate risks associated with this vulnerability.

Affected Version(s)

MathJax: LaTeX for Drupal 0.0.0 < 4.1.2

References

https://www.drupal.org/sa-contrib-2026-195

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

cilefen (cilefen)
bchin
cilefen (cilefen)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.