fix(deps): update dependency katex to ^0.18.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
katex (source)	^0.16.11 → ^0.18.0

---

KaTeX: Existing prototype pollution can bypass trust restrictions

CVE-2026-103923 / GHSA-238p-pmpm-9mq7

More information

Details

Impact

KaTeX can act as a read-side prototype pollution gadget in applications where Object.prototype has already been polluted, or where an attacker can influence the prototype of the renderer options object. (KaTeX does not enable said prototype pollution. This advisory applies when combining KaTeX with other vulnerable software that allows for prototype pollution.)

Affected versions may treat inherited properties from Object.prototype as renderer options, internal setting metadata, or namespace entries. In particular, an inherited trust value will be treated as though the application explicitly enabled trusted rendering, rather than using the documented default of false.

With attacker-controlled mathematical expressions, this can produce links capable of user-interaction cross-site scripting or load attacker-selected external resources. Exploitation requires the consuming application to insert KaTeX output into a web page without a separate sanitizer. (KaTeX does not execute scripts merely by rendering an expression.)

Other inherited settings can alter rendering behavior or resource limits. Inherited setting metadata can affect how defaults and supplied options are processed, while inherited namespace properties can be mistaken for defined macros or other internal values.

Patches

Upgrade to KaTeX v0.18.2 to remove this vulnerability.

Workarounds

• Address any prototype-pollution vulnerability in the application or its dependencies.
• delete Object.prototype.trust, delete Object.prototype.default, and delete Object.prototype.processor before calling KaTeX
• Do not allow untrusted input to control the renderer options object or its prototype.
• Sanitize KaTeX-generated HTML before inserting it into a document.

Details

KaTeX previously used ordinary JavaScript property access in the following contexts:

• Renderer settings could be inherited from the prototype of the options object.
• Internal default and processor setting metadata could be inherited from Object.prototype.
• Namespace lookup could treat inherited properties as built-in definitions.
• Namespace group restoration could preserve an inherited property as though it had been an explicitly defined value.

The fix adds own-property checks to each of these paths. Inherited properties are no longer accepted as renderer settings, setting metadata, namespace definitions, or values to be restored after a group ends.

For more information

If you have any questions or comments about this advisory:

• Open an issue or security advisory in the KaTeX repository
• Email us at katex-security@mit.edu

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7
• https://nvd.nist.gov/vuln/detail/CVE-2026-103923
• https://github.com/KaTeX/KaTeX/pull/4260
• https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4
• https://github.com/KaTeX/KaTeX/releases/tag/v0.18.2
• https://github.com/advisories/GHSA-238p-pmpm-9mq7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

KaTeX/KaTeX (katex)

v0.18.2

Compare Source

Bug Fixes

• prevent prototype pollution in settings (#​4260) (0adf7e7)

v0.18.1

Compare Source

Features

• handle character metrics warnings via strict (#​4243) (4237070)

v0.18.0

Compare Source

Features

• prefix css classes (#​4229) (6f5c44f)

BREAKING CHANGES

• users who apply custom styles or have allowlists targeting KaTeX's internal classes must update their selectors.

v0.17.0

Compare Source

Performance Improvements

• simplify defineFunction to avoid destructuring, improve typing (#​4222) (fb604e6)

BREAKING CHANGES

• The internal API for __defineFunction changed: you should no longer wrap properties in props.

0.16.47 (2026-05-16)

Bug Fixes

• correct size of [ big delimiter (#​4217) (7ba0027), closes #​4215

0.16.46 (2026-05-13)

Bug Fixes

• preserve math font in some styling commands (#​4214) (e9ee046), closes #​4213

0.16.45 (2026-04-05)

Bug Fixes

• wrap vcenter mpadded in mrow for valid MathML (#​4193) (ee66b78), closes #​4078

0.16.44 (2026-03-27)

Bug Fixes

• remove extra \jot space at bottom of align/gather/etc. (#​4184) (3870ee9)

0.16.43 (2026-03-26)

Bug Fixes

• use makeEm() consistently to truncate long CSS decimals (#​4181) (0967dcc)

0.16.42 (2026-03-24)

Features

• \underbracket and \overbracket (#​4147) (5be9abb)

0.16.41 (2026-03-24)

Bug Fixes

• \sout in text mode (#​4173) (e748578)

0.16.40 (2026-03-20)

Bug Fixes

• css: specify position: relative for .katex (#​4170) (020f0d8)

0.16.39 (2026-03-19)

Bug Fixes

• middle dot in text mode (#​4169) (edb45b0), closes #​3641

0.16.38 (2026-03-08)

Bug Fixes

• accent skew mixed with font specifiers (#​4159) (aea3375), closes #​4121

0.16.37 (2026-03-06)

Bug Fixes

• negative-width \hphantom and symmetric \smash (#​4153) (d4799ca)

0.16.36 (2026-03-06)

Bug Fixes

• contrib esm bloat (#​4157) (2bde1ad)

0.16.35 (2026-03-05)

Bug Fixes

• version number regression (#​4155) (db26b73)

0.16.34 (2026-03-05)

Bug Fixes

• emoji with variation selector (#​4151) (c2606e5)

0.16.33 (2026-02-23)

Bug Fixes

• scss: forward variables to fonts module (#​4146) (9349a64)

0.16.32 (2026-02-22)

Bug Fixes

• italic separation in \mathnormal (#​4143) (71305a0)

0.16.31 (2026-02-22)

Bug Fixes

• \*frac sizing (#​4137) (ef51f18)

0.16.30 (2026-02-22)

Bug Fixes

• no line breaks after \not (#​4140) (2d1ba86)

0.16.29 (2026-02-22)

Bug Fixes

• \imath and other \html@mathml macros in arguments (#​4139) (a850cce)

0.16.28 (2026-01-25)

Bug Fixes

• type: add missing types definition path to package.json (#​4125) (0ef8921)

0.16.27 (2025-12-07)

Features

• support equals sign and surrounding whitespace in \htmlData attribute values (#​4112) (c77aaec)

0.16.26 (2025-12-07)

Bug Fixes

• \mathop followed by integral symbol (6fbad18)

0.16.25 (2025-10-13)

Features

• css: provide katex-swap.css that uses font-display: swap (#​3940) (b3f9ce6), closes #​2242

0.16.24 (2025-10-12)

Features

• support hex colors with alpha (#​4090) (8c9b306), closes #​4067 #fA6 #fA6f1

0.16.23 (2025-10-03)

Bug Fixes

• Support \def with arguments via macros option (#​4087) (80a8158)

0.16.22 (2025-04-09)

Bug Fixes

• \relax in base or exponent of super/subscript (#​4045) (1f43c84)

0.16.21 (2025-01-17)

Bug Fixes

• escape \htmlData attribute name (57914ad)

0.16.20 (2025-01-12)

Bug Fixes

• \providecommand does not overwrite existing macro (#​4000) (6d30fe4), closes #​3928

0.16.19 (2024-12-29)

Bug Fixes

• types: improve strict function type (#​4009) (4228b4e)

0.16.18 (2024-12-18)

Bug Fixes

• Actually publish TypeScript type definitions (#​4008) (629b873)

0.16.17 (2024-12-17)

Bug Fixes

• MathML combines multidigit numbers with sup/subscript, comma separators, and multicharacter text when outputting to DOM (#​3999) (7d79e22), closes #​3995

0.16.16 (2024-12-17)

Features

• ESM exports, TypeScript types (#​3992) (ea9c173)

0.16.15 (2024-12-09)

Features

• italic sans-serif in math mode via \mathsfit command (#​3998) (2218901)

0.16.14 (2024-12-08)

Features

• \dddot and \ddddot support (#​3834) (bda35cd), closes #​2744

0.16.13 (2024-12-08)

Bug Fixes

• \vdots and \rule support in text mode (#​3997) (0e08352), closes #​3990

0.16.12 (2024-12-08)

Features

• css: configurable margin for display math (#​3638) (3405001)

0.16.11 (2024-07-02)

Features

• add \emph (#​3963) (9f34da4), closes #​3566

0.16.10 (2024-03-24)

Bug Fixes

• \edef bypassing maxExpand via exponential blowup (e88b4c3)
• escape \includegraphics src and alt (c5897fc)
• force protocol to be lowercase for better protocol filtering (fc5af64), closes /datatracker.ietf.org/doc/html/rfc3986#section-3
• maxExpand limit with Unicode sub/superscripts (085e21b)

0.16.9 (2023-10-02)

Features

• Support bold Fraktur (#​3777) (240d5ae)

0.16.8 (2023-06-24)

Features

• expose error length and raw error message on ParseError (#​3820) (710774a)

0.16.7 (2023-04-28)

Bug Fixes

• docs/support_table.md: delete redundant "varPsi" (#​3814) (33a1b98)

0.16.6 (2023-04-17)

Bug Fixes

• Support \let via macros option (#​3738) (bdb0be2), closes #​3737 #​3737

0.16.5 (2023-04-17)

Features

• __defineFunction API exposing internal defineFunction (#​3805) (c7b1f84), closes #​3756

0.16.4 (2022-12-07)

Bug Fixes

• space should prevent optional argument to \ (#​3746) (a0deb34), closes #​3745

0.16.3 (2022-10-22)

Bug Fixes

• \hline after \cr (#​3735) (ebf6bf5), closes #​3734

0.16.2 (2022-08-29)

Bug Fixes

• auto-render: concatenate content of successive text nodes (#​3422) (4d3fdd8)
• Implement \pmb via CSS text-shadow (#​3505) (176552a)

0.16.1 (2022-08-28)

Bug Fixes

• Use SVGs for some stacked delims (#​3686) (8a65a2e)

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review-active

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: Zoo-Code-Org/Zoo-Code/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 7df2d549-e174-42c2-b19f-3831d422e440

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Review status

This PR was opened by an automated account. A human maintainer must verify the change intent, provenance, and validation before merging.

Current step: Awaiting fresh human maintainer or CODEOWNER approval.

Review-state labels are managed by this workflow; do not edit them manually. community-approved is managed the same way — do not add or remove it manually. It signals a fresh community code approval for the current head as an advisory priority only; maintainer review is still required.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!