PT-2020-19760

Name of the Vulnerable Software and Affected Versions mathjs versions prior to 7.5.1 Description The issue concerns Prototype Pollution via the deepExtend function, which is triggered by configuration updates. This function is part of the mathjs package. Recommendations For versions prior to 7.5....

@baic/yolk (>=1.0.0-alpha.2, <=1.0.0-alpha.43), @baic/yolk-miniapp (>=1.0.0-alpha.1, <=1.0.0-alpha.43) +4 more potentially affected by CVE-2020-7743 via mathjs (>=7.1.0, <=7.5.0)

mathjs NPM version =7.1.0, =1.0.0-alpha.2, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.3, =2.0.12, =2.2.25 Source cves: CVE-2020-7743 Source advisory: SNYK:JS-MATHJS-1016401...

Prototype Pollution

Overview mathjs is a math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with diff. Affected versions of this package are...

Arbitrary Code Execution

mathjs is vulnerable to arbitrary code exection through javascript injection. The vulnerability exists as arbitrary method in Object.prototype can be called through validateSafeMethod...

@carnesen/mathjs-app (>=0.0.2, <=0.0.5), @ia-cloud/node-red-contrib-ia-cloud-fds-raspberry-pi (>=0.1.0, <=0.1.1) +29 more potentially affected by CVE-2017-1001003 via mathjs (>=3.4.1, <=3.16.5)

mathjs NPM version =3.4.1, =0.0.2, =0.1.0, =1.0.0-beta.1, =1.19.0, =1.13.0, =1.1.8, =0.0.3, =1.0.16, =0.1.0, =1.0.0, =1.0.2 - mdlt 0.0.4 and more Source cves: CVE-2017-1001003 Source advisory: OSV:GHSA-PV8X-P9HQ-J328...

@carnesen/mathjs-app (>=0.0.2, <=0.0.5), @ia-cloud/node-red-contrib-ia-cloud-fds-raspberry-pi (>=0.1.0, <=0.1.1) +29 more potentially affected by CVE-2017-1001003 via mathjs (>=3.4.1, <=3.16.5)

mathjs NPM version =3.4.1, =0.0.2, =0.1.0, =1.0.0-beta.1, =1.19.0, =1.13.0, =1.1.8, =0.0.3, =1.0.16, =0.1.0, =1.0.0, =1.0.2 - mdlt 0.0.4 and more Source cves: CVE-2017-1001003 Source advisory: GHSA-PV8X-P9HQ-J328...

@carnesen/mathjs-app (>=0.0.2, <=0.0.5), @ia-cloud/node-red-contrib-ia-cloud-fds-raspberry-pi (>=0.1.0, <=0.1.1) +29 more potentially affected by CVE-2017-1001002 via mathjs (>=3.4.1, <=3.16.5)

mathjs NPM version =3.4.1, =0.0.2, =0.1.0, =1.0.0-beta.1, =1.19.0, =1.13.0, =1.1.8, =0.0.3, =1.0.16, =0.1.0, =1.0.0, =1.0.2 - mdlt 0.0.4 and more Source cves: CVE-2017-1001002 Source advisory: OSV:GHSA-VX5C-87QX-CV6C...

@carnesen/mathjs-app (>=0.0.2, <=0.0.5), @ia-cloud/node-red-contrib-ia-cloud-fds-raspberry-pi (>=0.1.0, <=0.1.1) +29 more potentially affected by CVE-2017-1001002 via mathjs (>=3.4.1, <=3.16.5)

mathjs NPM version =3.4.1, =0.0.2, =0.1.0, =1.0.0-beta.1, =1.19.0, =1.13.0, =1.1.8, =0.0.3, =1.0.16, =0.1.0, =1.0.0, =1.0.2 - mdlt 0.0.4 and more Source cves: CVE-2017-1001002 Source advisory: GHSA-VX5C-87QX-CV6C...

Math.js JavaScript Engine Arbitrary Code Execution Vulnerability

Math.js is a math library for JavaScript and Node.js , it supports symbolic computation , a large number of built-in functions and constants . JavaScript engine is one of the JavaScript engine . An arbitrary code execution vulnerability exists in the JavaScript engine in versions of Math.js prior...

Arbitrary Code Execution

mathjs is vulnerable to arbitrary code execution attacks. The attacks are possible because it uses the unsafe method typed-function, which allows the creation of a typed function with JavaScript code in the name...

3net.js (>=0.0.1, <=0.2.4), @carnesen/mathjs-app (>=0.0.2, <=0.0.5) +140 more potentially affected by CVE-2017-1001003 via mathjs (>=0.9.1, <=3.16.5)

mathjs NPM version =0.9.1, =0.0.1, =0.0.2, =0.1.0, =1.2.2, =1.2.2, =1.2.2, =0.1.1, =1.0.0, =1.0.1, =1.0.0-beta.1, =0.3.1, =0.1.0, =0.3.0, =1.3.1 and more Source cves: CVE-2017-1001003 Source advisory: MEND:CVE-2017-1001003...

3net.js (>=0.0.1, <=0.2.4), @carnesen/mathjs-app (>=0.0.2, <=0.0.5) +140 more potentially affected by CVE-2017-1001002 via mathjs (>=0.9.1, <=3.16.5)

mathjs NPM version =0.9.1, =0.0.1, =0.0.2, =0.1.0, =1.2.2, =1.2.2, =1.2.2, =0.1.1, =1.0.0, =1.0.1, =1.0.0-beta.1, =0.3.1, =0.1.0, =0.3.0, =1.3.1 and more Source cves: CVE-2017-1001002 Source advisory: MEND:CVE-2017-1001002...

Remote Code Execution (RCE)

MathJS is vulnerable to remote code execution RCE attacks. These attacks are possible when evaluating expressions...

Remote Code Execution (RCE)

MathJS is vulnerable to remote code execution RCE attacks. These attacks are possible through the eval function...

Remote Code Execution (RCE)

MathJS is vulnerable to remote code execution RCE attacks. These attacks are possible through the eval function...

Remote Code Execution (RCE)

MathJS is vulnerable to remote code execution RCE attacks. These attacks are possible when parsing text as it has its own implementation of certain math-related functions, but also includes all of the regular JavaScript functions...