{"items":[{"id":"NVI-00017558","kind":"vulnerability","title":"ratex-parser panics on `\\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4hgp-59h5-gvrj","CVE-2026-53530"],"plain_summary":"GitHub lists this reviewed advisory for ratex-parser. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1ebcee9a1a506bcc9dfe9aede3e6bdc4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1ebcee9a1a506bcc9dfe9aede3e6bdc4","url":"https://github.com/advisories/GHSA-4hgp-59h5-gvrj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4hgp-59h5-gvrj","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:51.634Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1ebcee9a1a506bcc9dfe9aede3e6bdc4"],"technology":"ratex-parser","known_exclusions":[],"conditions_summary":"### Summary\n\nThe public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\\verbéxé` (i.e. `\\verb` followed by the non-ASCII delimiter `é`). When handling a `\\verb` command, the parser slices the verbatim argument with **byte** indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = \"abort\"` (`Cargo.toml:48`), the panic aborts the **entire process** — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX.\n\n\n\n### Details\n\n\n## Affected code\n\n`crates/ratex-parser/src/parser.rs`, `parse_symbol_inner`:\n\n```rust\nif let Some(stripped) = text.strip_prefix(\"\\\\verb\") {       // parser.rs:901\n    self.consume();\n    let arg = stripped.to_string();                         // e.g. \"éxé\"\n    let star = arg.starts_with('*');\n    let arg = if star { &arg[1..] } else { &arg };          // parser.rs:905  (also byte-sliced)\n    if arg.len() < 2 {                                      // byte length\n        return Err(ParseError::new(\"\\\\verb ","public_affected_ranges":["< 0.1.11"]}],"null_published_at":"2026-11-05T19:10:21.414Z","source_updated_at":"2026-07-07T23:39:13.000Z","source_disclosed_at":"2026-07-07T23:39:12.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:51.634Z"}],"next_cursor":null,"snapshot_revision":"42594"}