If you're building an app that handles LaTeX, consider these defensive steps:
: Ensure your LaTeX compiler is running with --no-shell-escape to prevent system-level command execution. latex injection 51-73.zip
: If shell-escape is enabled, an attacker can run system commands like \write18{ls -la} to list files on the server. If you're building an app that handles LaTeX,
: Use a LaTeX Sanitizer to strip backslashes or dangerous keywords like \input , \include , and \write18 . and \write18 .