Arbitrary Code Execution in mathjs (GHSA-pv8x-p9hq-j328)
Published: 2017-12-18T22:27:53Z
Aliases: CVE-2017-1001003
Severity: CRITICAL · CWE: CWE-88

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.


## Recommendation

Upgrade to version 3.17.0 or later.

Affected packages:
package: ecosystem: npm
name: mathjs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.17.0