TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons.
CVSS 4.0MEDIUM 5.3·Network·No auth·User interaction·EPSS 0.00194·Published 2026-11-03·Fixed in 0.13.5CWE-79