CVE-2026-107252

Name of the Vulnerable Software and Affected Versions MathJax: LaTeX for Drupal versions 0.0.0 through 4.1.2

Description Improper neutralization of input during web page generation allows Cross-Site Scripting (XSS). The module integrates the MathJax library, a JavaScript-based LaTeX rendering solution, but includes library configurations that fail to escape JavaScript within the TeX it formats.

Recommendations Update MathJax: LaTeX for Drupal to a version newer than 4.1.2. Modify the CDN URL or the custom MathJax JavaScript configuration according to the MathJax Safe-mode instructions.