CVE-2025-29049

6.3 mediumEPSS 0.6%

Medium (6.3). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in mathlive 0.104.0.

Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrary code via the MathLive function.

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-04-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-qwj6-q94f-8425	npm	mathlive	<0.104.0	0.104.0

References

https://github.com/advisories/GHSA-qwj6-q94f-8425
https://github.com/arnog/mathlive/commit/abc26056fd5e29a99edfa96a0bbe855ea2a8b678
https://github.com/advisories/GHSA-qwj6-q94f-8425

Check your stack JSON