Mathjs
CVE-2017-1001003
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1Blast Radius
ecosystem impact- 24 npm packages depend on mathjs (9 direct, 15 indirect)
Ecosystem-wide dependent count for version 3.17.0.
DescriptionCVE.org
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
AnalysisAI
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-88. math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. Affected products include: Mathjs Project Mathjs. Version information: before 3.17.0.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configu
Remote code execution in Math.js expression parser allows authenticated attackers to execute arbitrary JavaScript code i
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today