CVE-2017-1001002: Arbitrary Code Execution in mathjs
Summary
CVE-2017-1001002: Arbitrary Code Execution in mathjs. Affects mathjs versions < 3.17.0. Fixed in 3.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mathjs package is an open-source JavaScript library that provides a comprehensive set of mathematical functions and expressions. It is commonly used for mathematical computations and formula parsing in various applications. However, versions prior to 3.17.0 of math.js are vulnerable to arbitrary code execution.
Vulnerability Detail
The vulnerability in math.js before version 3.17.0 allows for arbitrary code execution in the JavaScript engine. By creating a typed function with JavaScript code in the name, an attacker can trigger arbitrary execution of code. This can lead to unauthorized access, data manipulation, or other malicious activities depending on the context in which math.js is used.
How To Fix
Latest published version: 15.2.0 as of 22 Oct 2026
npm install mathjs@15.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.17.0
This is the first release that contains the fix.
npm install mathjs@3.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, updating to the latest version of math.js is the recommended solution.
Conclusion
The vulnerability in math.js allows for arbitrary code execution, posing a significant security risk. To mitigate this vulnerability, it is crucial to update math.js to version 3.17.0 or later. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mathjs →
FAQ
math.js is an open-source JavaScript library that provides mathematical functions and expression parsing capabilities.
The vulnerability allows for arbitrary code execution, which can lead to unauthorized access, data manipulation, or other malicious activities.
Updating math.js to version 3.17.0 or later will fix this vulnerability.
Versions prior to 3.17.0 of math.js are affected by this vulnerability.
There is no specific workaround mentioned for this vulnerability. Updating to the latest version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for mathjs.
