PatchClock

PHP security digest · 7 Oct 2026

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet. The module...

Unrated CVE-2026-107252

Package
drupal/mathjax
Fixed in
4.1.2
Published
Wed 7 Oct 2026, 17:16 LisbonUpdated Mon 26 Oct 2026, 04:25 Lisbon

In plain words

The module ships with library configurations that do not escape JavaScript inside the TeX they render. If an attacker can supply TeX rendered with an unsafe configuration, JavaScript in it may run on your Drupal site.

Am I affected?

Look for drupal/mathjax and its version in composer.lock. The advisory lists 4.1.2 as fixed but gives no affected version range. Check whether your MathJax library configuration escapes JavaScript within TeX, using the MathJax Safe-mode instructions as a reference. Release 4.1.2 adds a system status warning for unsafe configurations.

What to do

Check which version you have, then update to a fixed release for your branch (4.1.2):

composer show drupal/mathjax | grep versions
composer update drupal/mathjax

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

If you cannot upgrade immediately, modify either the CDN URL or the custom MathJax JavaScript configuration according to the MathJax Safe-mode instructions at https://docs.mathjax.org/en/v2.7/safe-mode.html.

The advisory's description

This module integrates the MathJax library into your Drupal site. MathJax is the modern JavaScript-based LaTeX rendering solution for the Internet.

The module ships with library configurations that do not escape JavaScript within the TeX it formats.

Notice: This release updates CDN URLs where possible and adds a system status warning for unsafe configurations. If you are unable to upgrade immediately, you can modify either the CDN URL or the custom MathJax JavaScript configuration according to the instructions in MathJax Safe-mode.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.