Repository navigation
rehype-katex: allow katex >=0.18.2 (GHSA-238p-pmpm-9mq7) #121
Description
katex versions below 0.18.2 are affected by GHSA-238p-pmpm-9mq7 ("Existing prototype pollution can bypass trust restrictions", low severity, published 2026-10-05). The first patched release is katex@0.18.2; the current release is 0.19.0.
rehype-katex@7.0.1 (and micromark-extension-math@3.1.0, which remark-math uses) declare katex: ^0.16.0, so dependents cannot pick up the patched KaTeX without a package-manager override, and npm audit / pnpm audit keep reporting the advisory for every app that renders math through this stack. Downstream example: streamdown / @streamdown/math (Vercel) depend on rehype-katex@^7.0.1.
Would it be possible to widen the katex range to include the patched line (e.g. ^0.16.0 || ^0.18.2 || ^0.19.0, if the API surface rehype-katex uses is unchanged) or to cut a release against katex@^0.18.2?
Thanks for maintaining these packages!
Activity
emre-mutlu commentedon Oct 11, 2026
Data point from a downstream app: we run
rehype-katex@7.0.1withkatex@0.19.0through a pnpm override (katex: ^0.19.0); bothrehype-katexandmicromark-extension-mathresolve to that single copy, andpnpm auditno longer reports GHSA-238p-pmpm-9mq7.Our tests pass unchanged, with no API change on our side:
katex,katex-mathml,katex-html,katex-displayoutput)$\frac{1}{$yields akatex-errorspan with aParseErrortitle and a vfile message fromrehype-katex; a valid formula later in the same paragraph still renderstrust: false:\href{javascript:…}produces nohrefSetup: unified 11.0.5, remark-math 6.0.0, remark-rehype 11.1.2, Node 24. Not covered: macros, mhchem,
strictoptions, the 0.18.x line, andmicromark-extension-math's own HTML compile path (we only go throughrehype-katex).rehype-katex: update `katex`
fix(markdown): render math with patched KaTeX 0.19
build(deps): update dependencies to latest (#87)
build(security): Dependabot 54 条批量处置——四线升级 + 2 条有据 dismiss（I-239） (#1218