Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview mathjs is a math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with diff. Affected versions of this package are...

@20syldev/api (>=2.6.0, <=2.8.0), @aalis/plugin-tool-math (>=0.1.0, <=0.12.0) +514 more potentially affected by CVE-2026-41139 via mathjs (>=13.1.0, <=15.1.1)

mathjs NPM version =13.1.0, =2.6.0, =0.1.0, =1.3.0, =2.0.0, =0.2.6, =0.3.0, =7.0.0, =7.0.0, =0.1.14, =0.13.1, =5.0.95, =1.0.0, =1.3.0-alpha.0 - @antsoo-lib/components 0.0.1 - @antsoo-lib/hooks 0.0.1 and more Source cves: CVE-2026-41139 Source advisory: GHSA-JVFF-X2QM-6286...

EUVD-2021-1224

Malware in sbrugna...

Cryptocurrency Stealer Malware Distributed via 13 NuGet Packages

Cybersecurity researchers have detailed the inner workings of the cryptocurrency stealer malware that was distributed via 13 malicious NuGet packages as part of a supply chain attack targeting .NET developers. The sophisticated typosquatting campaign, which was uncovered by JFrog late last month,...

Prototype Pollution

Overview mathjs before version 7.5.1 is vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates. Recommendation Upgrade to version 7.5.1 or later References - CVE - GitHub Advisory...

@baic/yolk (>=1.0.0-alpha.2, <=1.0.0-alpha.43), @baic/yolk-miniapp (>=1.0.0-alpha.1, <=1.0.0-alpha.43) +4 more potentially affected by CVE-2020-7743 via mathjs (>=7.1.0, <=7.5.0)

mathjs NPM version =7.1.0, =1.0.0-alpha.2, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.3, =2.0.12, =2.2.25 Source cves: CVE-2020-7743 Source advisory: OSV:GHSA-X2FC-MXCX-W4MF...

GHSA-X2FC-MXCX-W4MF Prototype Pollution in mathjs

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

@baic/yolk (>=1.0.0-alpha.2, <=1.0.0-alpha.43), @baic/yolk-miniapp (>=1.0.0-alpha.1, <=1.0.0-alpha.43) +4 more potentially affected by CVE-2020-7743 via mathjs (>=7.1.0, <=7.5.0)

mathjs NPM version =7.1.0, =1.0.0-alpha.2, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.3, =2.0.12, =2.2.25 Source cves: CVE-2020-7743 Source advisory: GHSA-X2FC-MXCX-W4MF...

Prototype Pollution in mathjs

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

Prototype Pollution

mathjs is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

Default configuration

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743 Prototype Pollution

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

2d-transformation-solver (>=0.1.1, <=0.2.0), 2diminterpulator (1.0.0) +1065 more potentially affected by CVE-2020-7743 via mathjs (>=0.9.1, <=7.5.0)

mathjs NPM version =0.9.1, =0.1.1, =1.0.0-rc.1, =0.0.1, =0.9.0, =1.0.0, =1.2.0, =1.2.0, =1.0.0, =0.0.1-beta, =0.0.1-beta, =0.0.1-beta, =0.0.0, =0.1.2 and more Source cves: CVE-2020-7743 Source advisory: MEND:CVE-2020-7743...

CVE-2020-7743

The vulnerability described in CVE-2020-7743 affects the mathjs package prior to version 7.5.1, enabling Prototype Pollution via the deepExtend function during configuration updates. This is a general software vulnerability in mathjs, with no explicit exploit details provided in the connected doc...

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...

CVE-2020-7743: Improperly Controlled Modification of Object Prototype Attributes

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates...