Novel Planetary Movement
Severity: critical

Arbitrary Code Execution

mathjs

Overview

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.

Remediation

Update to version 3.17.0 or later.

Advisory timeline

  1. published

    Advisory published
    Dec 6th, 2017
  2. reported

    Dec 6th, 2017