CVE-2017-1001003
CriticalSummary
math.js versions before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
Risk Assessment
This could lead to unauthorized modification of objects, jeopardizing the integrity of applications using this library.
Recommendation
It is recommended to upgrade to math.js version 3.17.0 or later to mitigate this vulnerability.
Other vulnerabilities in math.js
See all- CVE-2017-1001002Critical
math.js versions before 3.17.0 have an arbitrary code execution vulnerability in the JavaScript engine. Creating a typed function with JavaScript code in the name could lead to unauthorized code execution.
- CVE-2026-41139High
The math.js library for JavaScript and Node.js versions 13.1.0 through 15.1.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
- CVE-2026-40897High
Math.js library for JavaScript and Node.js versions 13.1.1 through 15.2.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
Original NVD description (English source)
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.