Stored XSS in TeXlyre via malicious recipe icon import
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting flaw (CWE-79) in how it handles recipe icons. An attacker can supply a malicious LSP or typesetter recipe icon containing an HTML event handler, and when a victim imports the recipe, the script runs and can persistently access local projects and repository credentials. The attacker must trick the victim into importing the recipe.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade TeXlyre to version 0.13.5, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA texlyre (TeXlyre) Fixed in 0.13.5
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121588
- 2026-11-03 Alias added: GHSA-wq84-cxfr-wg2c
References
Sources
- CVE-2026-121588 · CVE Program
- CVE-2026-121588 · NVD
- FIRST EPSS
- GHSA-wq84-cxfr-wg2c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences