PatchTheCVEmiktex vulnerabilities and fixes
Recent CVEs affecting miktex, with upgrade or downgrade steps. 2 tracked.
miktex has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2023-05-20. Highest priority: CVE-2023-32700 (score 42/100).
- CVE-2023-32700 HIGH 7.8 UPGRADE UPGRADE LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u
- CVE-2023-32668 MEDIUM 5.5 UPGRADE UPGRADE LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests
FAQ
How do I fix miktex vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is miktex being exploited right now?
None of the tracked miktex CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which miktex CVE should I patch first?
CVE-2023-32700 currently ranks highest (42/100): LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an u.