CVE-2017-1001003

State: Published
Severity: Not scored
Published: Nov 27, 2017
Updated: Sep 17, 2024
Reserved: Nov 27, 2017

Description

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

Scores

The record has no CVSS score.

Weaknesses

CWE-88 Argument Injection or Modification

Affected Products

Product	Versions
math.jsmath.js	3.17.0Affected

References

https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170
https://github.com/josdejong/mathjs/commit/a60f3c8d9dd714244aed7a5569c3dccaa3a4e761

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.