Threats affecting pkg:github/texlyre/texlyre

TeXlyre versions from 0.11.0 up to but not including 0.13.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts by supplying crafted LSP or typesetter recipe icons containing HTML event handlers. Successful exploitation can lead to persistent script execution, potentially exposing local projects and repository credentials to attackers.