PT-2026-136299

CVE-2026-121588

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TeXlyre versions 0.11.0 through 0.13.4

Description A stored cross-site scripting issue exists where attackers can execute scripts by providing malicious LSP or typesetter recipe icons. By tricking victims into importing a recipe containing an HTML event handler in its icon, attackers can persistently access local projects and repository credentials.

Recommendations Update TeXlyre to version 0.13.5 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Nodirjon Xojiakbarov

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers