---
id: CVE-2026-53530
title: RaTeX is a KaTeX-compatible math rendering engine written in Rust
summary: >-
  RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to
  version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)`
  panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII
  delimiter …
severity: high
cwe:
  - CWE-248
  - CWE-400
  - CWE-1285
vendor: ratex-parser
product: ratex-parser
affected:
  - ratex-parser < 0.1.11
patched:
  - ratex-parser 0.1.11
published: '2026-08-21'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:06:39.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53530'
references:
  - url: 'https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj'
    label: security-advisories@github.com
  - url: 'https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-4hgp-59h5-gvrj'
tags:
  - nvd
  - ghsa
  - rust
epss: 0.00428
epssPercentile: 0.34322
aliases:
  - GHSA-4hgp-59h5-gvrj
ecosystem: rust
ingestedAt: '2026-07-07T23:43:59.382Z'
---

## Overview

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53530)

Affected packages:

- `ratex-parser < 0.1.11`

Patched in:

- `ratex-parser 0.1.11`

Source: https://github.com/advisories/GHSA-4hgp-59h5-gvrj