Mathjs
Monthly
Remote code execution in Math.js expression parser allows authenticated attackers to execute arbitrary JavaScript code in versions 13.1.0 through 15.1.x. The vulnerability stems from unsafe property access controls (CWE-915) that can be exploited via crafted mathematical expressions. Patched in version 15.2.0 with comprehensive property access validation (commit bcf0da4, PR #3656). No active exploitation confirmed by CISA KEV, but public patch code reveals exploitable attack surface involving prototype pollution or unsafe property traversal. CVSS 8.8 with network vector and low complexity indicates high real-world risk for applications exposing Math.js parsing to user input.
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Remote code execution in Math.js expression parser allows authenticated attackers to execute arbitrary JavaScript code in versions 13.1.0 through 15.1.x. The vulnerability stems from unsafe property access controls (CWE-915) that can be exploited via crafted mathematical expressions. Patched in version 15.2.0 with comprehensive property access validation (commit bcf0da4, PR #3656). No active exploitation confirmed by CISA KEV, but public patch code reveals exploitable attack surface involving prototype pollution or unsafe property traversal. CVSS 8.8 with network vector and low complexity indicates high real-world risk for applications exposing Math.js parsing to user input.
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.