{"action":"Upgrade katex to 0.16.10 or later.","affected":[{"fixed":"0.16.10","introduced":"0.15.4"}],"component":"katex","cve_ids":["CVE-2024-28244"],"ecosystem":"npm","epss":0.02155,"exploited":false,"fixed_versions":["0.16.10"],"ghsa_id":"GHSA-cvr6-37gx-v8wc","id":"tcs_01M5KFKPJRFG34PJ8K913XXCY4","modified_at":"2026-09-10T03:50:10.288677780Z","published_at":"2024-03-25T19:38:29Z","references":["https://osv.dev/vulnerability/GHSA-cvr6-37gx-v8wc","https://github.com/KaTeX/KaTeX/security/advisories/GHSA-cvr6-37gx-v8wc","https://nvd.nist.gov/vuln/detail/CVE-2024-28244","https://github.com/KaTeX/KaTeX/commit/085e21b5da05414efefa932570e7201a7c70e5b2","https://github.com/KaTeX/KaTeX"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cvr6-37gx-v8wc","url":"https://osv.dev/vulnerability/GHSA-cvr6-37gx-v8wc"}],"summary":"KaTeX's maxExpand bypassed by Unicode sub/superscripts"}