MathJax security and disabling MathJax.

[kramerrs]

A security scanner marked the version of MathJax that Rmarkdown uses as a security vulnerability.
In Rmarkdown I was able to disable mathjax so that it isn't deployed, we weren't using mathjax. However, now the pandoc spews warnings profusely, though the document is correctly rendered and functions fine.

I have attempted a few self help techniques, passing them to pandoc via Rmarkdown's pandoc_args statement. For example, I have tried
--mathjax and --quiet --mathml etc.

EG to the effect of:
[WARNING] Could not convert TeX math

This is what the render method of Rmarkdown is using, to pass arguments to pandoc if that helps. I highlighted the --mathjax --quiet arguments below.

Ideally, the MathJax security issue goes away, but it seems that Rmarkdown is hasn't migrated to the later versions of MathJax. We don't use MathJax anyway, so it would also be nice to keep the thing light weight.

C:/Program Files/RStudio/bin/pandoc/pandoc" +RTS -K512m -RTS bpmt_web.knit.md --to html4 --from markdown+autolink_bare_uris+tex_math_single_backslash --output output.html --lua-filter " AppData\Local\R\cache\R\renv\cache\v5\R-4.0\x86_64-w64-mingw32\rmarkdown\2.26\9b148e7f95d33aac01f31282d49e4f44\rmarkdown\rmarkdown\lua\pagebreak.lua" --lua-filter "\AppData\Local\R\cache\R\renv\cache\v5\R-4.0\x86_64-w64-mingw32\rmarkdown\2.26\9b148e7f95d33aac01f31282d49e4f44\rmarkdown\rmarkdown\lua\latex-div.lua" --mathjax --quiet --variable bs3=FALSE --standalone --section-divs --template "\AppData\Local\R\cache\R\renv\cache\v5\R-4.0\x86_64-w64-mingw32\flexdashboard\0.5.2\a0534e167498732ac0137e7ba46364dc\flexdashboard\rmarkdown\templates\flex_dashboard\resources\default.html" --id-prefix section- --variable theme=bootstrap --include-in-header "\AppData\Local\Temp\RtmpCk0pzt\file1710c813a26html" --highlight-style pygments --include-before-body "\AppData\Local\Temp\RtmpCk0pzt\file1710821ae7.html" --include-after-body "\AppData\Local\Temp\RtmpCk0pzt\file17103a9f79bb.html" --include-in-header "\AppData\Local\R\cache\R\renv\cache\v5\R-4.0\x86_64-w64-mingw32\rmarkdown\2.26\9b148e7f95d33aac01f31282d49e4f44\rmarkdown\rmd\h\shiny-header.html"

[jgm]

You're wondering about the warnings

[WARNING] Could not convert TeX math

These are warnings pandoc emits when it tries to convert from TeX math to some other format and can't (either because of its own limitations or the limitations of the other format). You should not get these when using --mathjax, because TeX math will be passed through verbatim.

Anyway, I'm not quite sure what your question is?

[kramerrs]

I wasn't sure if this was a bug, and I am not volunteering to put together a reprex.

[jgm]

Certainly if RMarkdown is using a vulnerable MathJax version, you might report this to them.
Pandoc itself just uses the latest version, which, hopefully, isn't problematic.

[kramerrs]

It is already on their roadmap. Just have to make the vulnerabilities go away now. EG MathJax: NULL Why is MathJax deployed when it isn't used though? Something to think about.