MathJax v2.7.9: Regular Expression Denial of Service (ReDoS) Vulnerabilities in MathJax.js

CVE-2023-39663 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the components pattern and markdownPattern. NOTE: the vendor disputes this because the regular expressions are not applied to user input; thus, there is no risk.

Learn more about our User Device Pen Test.