Threats affecting pkg:github/texlyre

TeXlyre versions from 0.11.0 up to but not including 0.13.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts by supplying crafted LSP or typesetter recipe icons containing HTML event handlers. Successful exploitation can lead to persistent script execution in victims' environments, potentially exposing local projects and repository credentials. The vulnerability is fixed in version 0.13.5.