CVE-2017-1001002
CriticalSummary
math.js versions before 3.17.0 have an arbitrary code execution vulnerability in the JavaScript engine. Creating a typed function with JavaScript code in the name could lead to unauthorized code execution.
Risk Assessment
Organizations may be exposed to attacks that allow the execution of malicious code, potentially leading to data loss or system takeover.
Recommendation
It is recommended to upgrade math.js to version 3.17.0 or later to mitigate this vulnerability.
Other vulnerabilities in math.js
See all- CVE-2017-1001003Critical
math.js versions before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
- CVE-2026-41139High
The math.js library for JavaScript and Node.js versions 13.1.0 through 15.1.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
- CVE-2026-40897High
Math.js library for JavaScript and Node.js versions 13.1.1 through 15.2.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
Original NVD description (English source)
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.