@carnesen/mathjs-app (>=0.0.2, <=0.0.5), @ia-cloud/node-red-contrib-ia-cloud-fds-raspberry-pi (>=0.1.0, <=0.1.1) +29 more potentially affected by CVE-2017-1001003 via mathjs (>=3.4.1, <=3.16.5)

mathjs NPM version =3.4.1, =0.0.2, =0.1.0, =1.0.0-beta.1, =1.19.0, =1.13.0, =1.1.8, =0.0.3, =1.0.16, =0.1.0, =1.0.0, =1.0.2 - mdlt 0.0.4 and more Source cves: CVE-2017-1001003 Source advisory: OSV:GHSA-PV8X-P9HQ-J328...

CVE-2017-1001003

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object...

CVE-2017-1001003

CVE-2017-1001003 affects math.js prior to 3.17.0. The issue allows private properties (e.g., a constructor) to be replaced by using Unicode characters when creating an object, which can alter object behavior. Documents reference upgrades to 3.17.0+ as the advised remediation and indicate the vuln...