{"action":"Upgrade mathlive to 0.110.0 or later.","affected":[{"fixed":"0.110.0","introduced":"0"}],"component":"mathlive","cve_ids":["CVE-2026-54705"],"ecosystem":"npm","epss":0.00362,"exploited":false,"fixed_versions":["0.110.0"],"ghsa_id":"GHSA-fm7p-gw32-828p","id":"tcs_01M5KFNRRAMR94RYMD1B58GWC3","modified_at":"2026-07-29T17:41:44.693943Z","published_at":"2026-07-29T17:21:26Z","references":["https://osv.dev/vulnerability/GHSA-fm7p-gw32-828p","https://github.com/arnog/mathlive/security/advisories/GHSA-fm7p-gw32-828p","https://github.com/arnog/mathlive/issues/3028","https://github.com/arnog/mathlive/commit/5fe1c46153883f9ec0249a5c8c34e64aaae9cfb8","https://github.com/arnog/mathlive"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-fm7p-gw32-828p","url":"https://osv.dev/vulnerability/GHSA-fm7p-gw32-828p"}],"summary":"mathlive's Lack of Escaping of HTML allows for XSS"}