CVE-2017-1001003

Critical

Published: 27/11/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

math.js versions before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

Risk Assessment

This could lead to unauthorized modification of objects, jeopardizing the integrity of applications using this library.

Recommendation

It is recommended to upgrade to math.js version 3.17.0 or later to mitigate this vulnerability.

Original NVD description (English source)

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.