: Using \input{/etc/passwd} to trick the server into printing the contents of its system files directly into a PDF.
If you're building an app that handles LaTeX, consider these defensive steps:
Most people think of LaTeX as a harmless tool for making math homework look pretty. In reality, it is a powerful programming language. If a website takes user input to generate a PDF (like a resume builder or invoice generator) without cleaning that input, an attacker can "inject" commands. 🛡️ Common Attack Vectors
🚀 LaTeX Injection - Payloads All The Things
: Use a LaTeX Sanitizer to strip backslashes or dangerous keywords like \input , \include , and \write18 .
: Run the compilation process in a "jail" or isolated container so that even if an injection happens, the attacker can't access your host system.
: If shell-escape is enabled, an attacker can run system commands like \write18{ls -la} to list files on the server.
: Using \input{/etc/passwd} to trick the server into printing the contents of its system files directly into a PDF.
If you're building an app that handles LaTeX, consider these defensive steps: latex injection 51-73.zip
Most people think of LaTeX as a harmless tool for making math homework look pretty. In reality, it is a powerful programming language. If a website takes user input to generate a PDF (like a resume builder or invoice generator) without cleaning that input, an attacker can "inject" commands. 🛡️ Common Attack Vectors : Using \input{/etc/passwd} to trick the server into
🚀 LaTeX Injection - Payloads All The Things If a website takes user input to generate
: Use a LaTeX Sanitizer to strip backslashes or dangerous keywords like \input , \include , and \write18 .
: Run the compilation process in a "jail" or isolated container so that even if an injection happens, the attacker can't access your host system.
: If shell-escape is enabled, an attacker can run system commands like \write18{ls -la} to list files on the server.