CVE-2017-1001003: Arbitrary Code Execution in mathjs
Summary
CVE-2017-1001003: Arbitrary Code Execution in mathjs. Affects mathjs versions < 3.17.0. Fixed in 3.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mathjs package is an open-source JavaScript library that provides a comprehensive set of mathematical functions and expressions. It is commonly used for mathematical computations in web applications and Node.js environments. The package allows users to perform complex mathematical operations, including symbolic computation, matrix operations, and statistical analysis. However, versions of math.js prior to 3.17.0 are vulnerable to arbitrary code execution due to a flaw in handling private properties during object creation.
Vulnerability Detail
The vulnerability in math.js arises from the ability to replace private properties, such as a constructor, by using Unicode characters when creating an object. This can be exploited by an attacker to execute arbitrary code within the context of the application using math.js. The impact of this vulnerability can be severe, as it allows an attacker to execute malicious code, potentially leading to unauthorized access, data breaches, or system compromise. The vulnerability is classified as critical (CWE-88) and should be addressed immediately.
How To Fix
Latest published version: 15.2.0 as of 22 Oct 2026
npm install mathjs@15.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.17.0
This is the first release that contains the fix.
npm install mathjs@3.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the math.js package prior to version 3.17.0 is vulnerable to arbitrary code execution. It is crucial to upgrade to the latest version to mitigate the risk of this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mathjs →
FAQ
Math.js is an open-source JavaScript library that provides a wide range of mathematical functions and expressions for use in web applications and Node.js environments.
The vulnerability allows an attacker to execute arbitrary code within the context of the application using math.js, potentially leading to unauthorized access, data breaches, or system compromise.
To fix this vulnerability, upgrade to math.js version 3.17.0 or later, which includes a fix for the issue.
No workaround is available for this vulnerability. It is recommended to upgrade to the fixed version of math.js.
You can find more information about this vulnerability in the GitHub Security Advisory database: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for mathjs.
