Security Advisory

CVE-2024-53930: WikiDocs Stored Cross-Site Scripting via KaTeX Parser

Stored XSS in WikiDocs before 1.0.65 via KaTeX parser mishandling of user-controlled data after $$\\.

Overview

WikiDocs is a flat-file Markdown wiki. Its KaTeX math parser mishandles content placed after a $$\\ sequence, and that content reaches the rendered page without escaping.

Any authenticated user who can edit a page stores a script that runs for every reader of that page. WikiDocs 1.0.65 fixes the issue.

Affected products

  • WikiDocs before 1.0.65

Disclosure timeline

17 Nov 2024
Zavy86 releases WikiDocs 1.0.65 with the fix
25 Nov 2024
CVE-2024-53930 reserved and published