Description
This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.
Recommendation
Update the mathjs package to the latest compatible version. Followings are version details:
- Affected version(s): >= 13.1.0, < 15.2.0
- Patched version(s): 15.2.0
References
Could your website be exposed too?
SmartScanner can check your website for mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify - CVE-2019-10808
- Improperly Controlled Modification of Dynamically-Determined Object Attributes in vega-util - CVE-2019-10806
- radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') - CVE-2025-48054
- Improperly Controlled Modification of Object Prototype Attributes - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 08, 2026