Read the docs
TI-2026-38603 Aliases CVE-2026-53530GHSA-4hgp-59h5-gvrj

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

Priority HIGH 77CWE-1285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Fixed RaTeX (erweixin): 0.1.11ratex-parser (crates.io): 0.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
erweixinRaTeXbefore 0.1.110.1.11Patch availableCNA
—ratex-parser (crates.io)before 0.1.110.1.11Patch availableGHSA-4hgp-59h5-gvrj
  • RaTeX Vendorerweixin Affected before 0.1.11 Fixed in 0.1.11 Patch available CNA
  • ratex-parser (crates.io) Vendor— Affected before 0.1.11 Fixed in 0.1.11 Patch available GHSA-4hgp-59h5-gvrj

Remediation

  • Fix · CNA RaTeX (erweixin) Fixed in 0.1.11
  • Fix · GHSA-4hgp-59h5-gvrj ratex-parser (crates.io) Fixed in 0.1.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53530
  2. 2026-10-03 Alias added: GHSA-4hgp-59h5-gvrj

References

  • TI-2026-38604 ratex-parser has unbounded parser recursion that leads to stack overflow (process abort) CVSS 4.0MEDIUM 6.9

Sources