Description
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
Recommendation
Update the mathjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.17.0
- Patched version(s): 3.17.0
References
Could your website be exposed too?
SmartScanner can check your website for Arbitrary Code Execution in mathjs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Arbitrary Code Execution in mathjs - mathjs - CVE-2017-1001002
- React Editable Json Tree vulnerable to arbitrary code execution via function parsing - CVE-2022-36010
- Arbitrary Code Execution in underscore - CVE-2021-23358
- Electerm runWidget has a path traversal that leads to arbitrary code execution - CVE-2026-43940
You might also like:
See something that needs correcting? Let us knowUpdated September 12, 2023