Live › vulnerability › CVE-2026-107252
The MathJax: LaTeX module for Drupal fails to neutralize input when generating web pages, allowing cross-site scripting. An attacker who can get script into a rendered page can run it in a visitor's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the MathJax: LaTeX module at version 4.1.2 or earlier are exposed, because the module outputs user-supplied content without proper escaping. Sites without this module, or running a later version, are not affected. The sources do not say which page inputs are reachable by visitors.
No product ranges from the sources yet.
drush pm:list or the module list at /admin/modules) and see whether it is 4.1.2 or earlier.4.1.2; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-107252")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.