T03 · Remote Payload Retrieval and Execution
- Location
references/design-system.md:296- Finding
Generated HTML Executes Remote JavaScript Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
references/design-system.md:296-335andSKILL.md:463-466
Vulnerability Type: Remote third-party JavaScript execution without Subresource Integrity
Risk Level: HighVulnerable Code
html <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/katex.min.css"> <script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/katex.min.js"></script> <script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/contrib/auto-render.min.js" onload=" renderMathInElement(document.body, { delimiters: [ {left:'$$', right:'$$', display:true}, {left:'$', right:'$', display:false} ], throwOnError: false, macros: { '\\dj': '{\\text{đ}}', '\\degree': '{{}^\\circ}', '\\d': '{\\mathrm{d}}', '\\e': '{\\mathrm{e}}', '\\i': '{\\mathrm{i}}', '\\cdotp': '{\\cdot}', '\\unit': '{\\,\\text}', '\\celsius': '{{{}^\\circ\\text{C}}}', '\\bm': '{\\boldsymbol}' } }); "></script>Technical Analysis
The skill directs the agent to copy an HTML template that downloads and executes two JavaScript resources from
cdn.jsdelivr.netwhenever a generated study-notes file is opened. Although the URLs identify KaTeX version0.16.9, the script elements do not containintegrityattributes, and there is no Content Security Policy restricting script or network behavior.Consequently, the reviewed skill package does not contain the complete code that ultimately executes. Control of the CDN response, the associated package distribution, or a trusted network path could allow the returned JavaScript to differ from the code expected during the audit. The remote script executes with the same browser-document privileges as the legitimate KaTeX library.
This ...[truncated 1505 chars]
- Remediation
View remediation
Remediation Suggestions
- Vendor the exact KaTeX CSS, JavaScript, fonts, and auto-render component inside the skill or embed them directly into generated output.
- If a CDN must remain supported, add verified SHA-384 or SHA-512 Subresource Integrity hashes and
crossorigin="anonymous"to every external stylesheet and script:html <script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/katex.min.js" integrity="sha384-VERIFIED_HASH" crossorigin="anonymous"></script> - Generate integrity values from independently verified release artifacts rather than copying unverified hashes from the same delivery channel.
- Add a restrictive Content Security Policy. Prefer bundled scripts with hash-based authorization and set
connect-src 'none'if generated notes require no network access. - Remove inline event handlers such as
onloadand place the initialization logic in a bundled, reviewed script so that a strict CSP can be used. - Add an offline test confirming that generated files render correctly with networking disabled.