Description
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| math.js | math.js | 3.17.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | mathjs | < 3.17.0 | 3.17.0 | GHSA-pv8x-p9hq-j328 |