katex (npm) has 6 known vulnerabilities, the worst rated MODERATE. Upgrade to 0.18.2 or later to clear all of them. No malicious-package signal is recorded.
KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript…
CyberXYZ does not call a package safe in absolute terms. It records 6 known vulnerabilities for katex (npm), the worst rated MODERATE, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does katex have known vulnerabilities?
Yes. CyberXYZ records 6 known vulnerabilities for katex (npm), the worst rated MODERATE. These include GHSA-cg87-wmx4-v546, GHSA-64fm-8hw2-v72w, GHSA-3wc5-fcw2-2329, GHSA-f98w-7cxr-ff2h, GHSA-cvr6-37gx-v8wc.
Which version of katex should I use?
0.18.2 or later clears every advisory recorded for katex (npm). Check the release you pick before installing it.
How do I check katex before installing?
Search katex in CyberXYZ Check at https://cyberxyz.io/check?q=katex. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 12:27 UTC. The most recent advisory here was published 2026-10-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.