{"id":"CVE-2026-107252","kind":"vulnerability","aliases":["CVE-2026-107252"],"related":[],"title":"Drupal MathJax module: cross-site scripting lets attackers run page scripts","description":"Improper Neutralization of Input During Web Page Generation (\"Cross-site Scripting\") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.","summary":"The MathJax: LaTeX module for Drupal fails to neutralize input when generating web pages, allowing cross-site scripting. An attacker who can get script into a rendered page can run it in a visitor's browser.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","mathjax-latex","package","self-hosted"],"not_affected_if":["fixed-version","module-not-installed"],"how_to_check":"- Check the installed version of the MathJax: LaTeX for Drupal module (for example with `drush pm:list` or the module list at /admin/modules) and see whether it is `4.1.2` or earlier.","fix":"- Move the MathJax: LaTeX for Drupal module to a version later than `4.1.2`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-30T04:17:47+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","triaged_at":"2026-10-30T04:31:45+00:00","updated_at":"2026-10-30T04:31:45+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T04:31:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move the MathJax: LaTeX for Drupal module to a version later than `4.1.2`; the sources do not name the exact fixed release.","reach":"internet","title":"Drupal MathJax module: cross-site scripting lets attackers run page scripts","impact":"medium","summary":"The MathJax: LaTeX module for Drupal fails to neutralize input when generating web pages, allowing cross-site scripting. An attacker who can get script into a rendered page can run it in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","mathjax-latex","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and the exact input path from the Drupal security advisory for MathJax: LaTeX (the NVD entry gives no fix or CVSS data).","how_to_check":"- Check the installed version of the MathJax: LaTeX for Drupal module (for example with `drush pm:list` or the module list at /admin/modules) and see whether it is `4.1.2` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed","fixed-version"],"who_is_affected":"Drupal sites that run the MathJax: LaTeX module at version 4.1.2 or earlier are exposed, because the module outputs user-supplied content without proper escaping. Sites without this module, or running a later version, are not affected. The sources do not say which page inputs are reachable by visitors.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000711,"input_tokens":4134,"output_tokens":595,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107252':15A,18A '-2026':14A,17A '0.0.0':98C '4.1.2':100C 'affect':91C 'allow':41B,83C 'attack':9A,47B 'browser':63B 'cross':5A,43B,73C,85C 'cross-sit':4A,42B,72C,84C 'cve':13A,16A 'drupal':1A,19B,32B,78C,82C,95C 'fail':33B 'generat':38B,71C 'get':50B 'host':26B 'improp':64C 'input':36B,67C 'issu':90C 'latex':22B,29B,80C,93C 'let':8A 'mathjax':2A,21B,28B,79C,92C 'mathjax-latex':20B 'modul':3A,30B 'neutral':35B,65C 'packag':23B 'page':11A,40B,55B,70C 'render':54B 'run':10A,57B 'script':7A,12A,45B,51B,75C,87C 'self':25B 'self-host':24B 'site':6A,44B,74C,86C 'version':96C 'visitor':61B 'vulner':76C 'web':39B,69C 'xss':88C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the MathJax: LaTeX module at version 4.1.2 or earlier are exposed, because the module outputs user-supplied content without proper escaping. Sites without this module, or running a later version, are not affected. The sources do not say which page inputs are reachable by visitors.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107252","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107252","severity":null,"published_at":"2026-10-30T04:17:47+00:00","modified_at":"2026-10-30T04:17:47+00:00","first_seen_at":"2026-10-30T04:28:35+00:00","fetched_at":"2026-10-30T04:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}