CVE-2017-1001002

Critical

Published: 27/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

math.js versions before 3.17.0 have an arbitrary code execution vulnerability in the JavaScript engine. Creating a typed function with JavaScript code in the name could lead to unauthorized code execution.

Risk Assessment

Organizations may be exposed to attacks that allow the execution of malicious code, potentially leading to data loss or system takeover.

Recommendation

It is recommended to upgrade math.js to version 3.17.0 or later to mitigate this vulnerability.

Original NVD description (English source)

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.