CVE-2020-7743: Prototype Pollution in mathjs
Summary
CVE-2020-7743: Prototype Pollution in mathjs. Affects mathjs versions < 7.5.1. Fixed in 7.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mathjs package is an extensive math library for JavaScript that provides a wide range of mathematical functions and expressions. It is commonly used for mathematical computations and evaluations in various applications. However, versions before 7.5.1 are vulnerable to Prototype Pollution through the deepExtend function, which is executed during configuration updates.
Vulnerability Detail
Prototype Pollution is a vulnerability that occurs when an attacker can inject or modify properties of an object's prototype. In the case of mathjs, the deepExtend function is susceptible to this issue. An attacker can manipulate the prototype chain and introduce malicious properties or modify existing ones, leading to unexpected behavior or security breaches. This vulnerability can potentially allow an attacker to execute arbitrary code, escalate privileges, or cause denial-of-service attacks.
How To Fix
Latest published version: 15.2.0 as of 22 Oct 2026
npm install mathjs@15.2.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.5.1
This is the first release that contains the fix.
npm install mathjs@7.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the mathjs package to mitigate the risk of exploitation.
Conclusion
The Prototype Pollution vulnerability in mathjs can have severe consequences, including arbitrary code execution and privilege escalation. It is crucial to update the mathjs package to version 7.5.1 or later to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mathjs →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify an object's prototype, leading to unexpected behavior or security breaches.
This vulnerability in mathjs can potentially allow an attacker to execute arbitrary code, escalate privileges, or cause denial-of-service attacks.
To fix this vulnerability, update the mathjs package to version 7.5.1 or later using the command 'npm install mathjs@7.5.1'.
There are no known workarounds for this vulnerability. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-x2fc-mxcx-w4mf/GHSA-x2fc-mxcx-w4mf.json
References
Related vulnerabilities
Recent vulnerabilities recorded for mathjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
