The Mistune math plugin in Adr viewer bypasses the escape=True setting by rendering inline math ($...$) and block math ($$...$$) content without any HTML escaping. The plugin's render functions directly concatenate raw user input into the HTML output, ignoring the renderer's escape flag and not calling any sanitization functions. This results in a silent contract violation where developers expect XSS protection but receive none inside math delimiters. Proof-of-concept shows script tags and event handlers can execute when embedded inside math delimiters. The vulnerability affects Adr viewer versions >=1.3.0 and <1.4.0_5 and has a CVSS 3.1 score of 6.1 (medium severity). A patch is available.

An attacker can inject malicious HTML or JavaScript code inside math delimiters in markdown content processed by the Adr viewer's Mistune math plugin. This code is rendered unescaped in the browser, enabling cross-site scripting attacks that can lead to information disclosure (e.g., cookie theft) and other client-side impacts. The vulnerability violates the expected escape contract, potentially misleading developers about the safety of user input within math expressions.

A patch is available for Adr viewer versions >=1.3.0 <1.4.0_5 that fixes this vulnerability by properly escaping user input in the math plugin render functions. Users should upgrade to the fixed version as soon as possible. Until patched, avoid enabling or using the math plugin with untrusted user input or disable math rendering to prevent XSS risks.