Description
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| math.js | math.js | 3.17.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mathjs | < 3.17.0 | 3.17.0 | GHSA-vx5c-87qx-cv6c |