Live › vulnerability › CVE-2026-121588
TeXlyre versions 0.11.0 before 0.13.5 render HTML from recipe icons without sanitizing them, so a crafted recipe can run script in the app. An attacker who tricks a user into importing that recipe can reach local projects and repository credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Users of the TeXlyre editor in versions 0.11.0 through 0.12.x who import recipes from untrusted sources. Exposure requires a victim to import a malicious recipe; installations that only use built-in recipes are not described as affected.
No product ranges from the sources yet.
0.13.5.0.13.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-121588")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.