Jupenur

KaTeX is a JavaScript library for TeX math rendering on the web. Users who render untrusted mathematical expressions could encounter malicious input using `def` or ` ewcommand` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. KaTeX supports an option named `maxExpand` which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for Unicode (sub|super)script characters allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent.

KaTeX is a JavaScript library for TeX math rendering on the web. Users who render untrusted mathematical expressions could encounter malicious input using `edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow.

The `core.exportVariable` function uses a well-known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author.

The issue is a DoS vulnerability due to a bug in the library that allows an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows, potentially compromising the server's ability to serve data. This issue only occurs when using the `graphql.MaxDepth` option in the schema.

The issue allows an attacker to bypass signature validation with a carefully crafted XML file, making it possible to pass off an altered file as a signed one. This is due to the behavior of encoding/xml, which can cause XML Digital Signature validation to be entirely bypassed.

The issue allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site when reader mode is enabled. This can be exploited by a remote attacker to manipulate the content of the window using a specially formed website, which is related to errors in security settings.

The issue allows remote attackers to spoof the address bar via crafted JavaScript code. This is achieved by using DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen.