markdown-it-texmath@0.4.2 vulnerabilities

markdown-it-texmath is a that add TeX math equations to your Markdown documents rendered by markdown-it parser.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Within texmath.js, it is possible to bypass the current validation and inject JavaScript within math renderer.

PoC

$$"<img/src=./ onerror=alert(location)>
e^{i\theta} = i\sin\thetae^{i\theta}
$$

Upgrade markdown-it-texmath to version 0.9.0 or higher.