CVE-2017-1001003

Published: Nov 27, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

Affected (1)

Products: Mathjs Project: Mathjs

Mathjs Project

1 product

Mathjs

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mathjs Project Mathjs	Before 3.17.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (4)

https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170

Source: 46fe6300-5254-4a98-9594-a9567bec8179

https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761

Source: 46fe6300-5254-4a98-9594-a9567bec8179

https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.