Read the docs

math.js

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

math.js records in CISA KEV

No math.js vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mathjs 3 records MEDIUM Math.js 1 record MEDIUM

Records

5 records

TI-2017-14722 CVE-2017-1001002 · GHSA-vx5c-87qx-cv6c

Code injection in math.js

Priority MEDIUM 47

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02357 Published 2017-11-27 Fixed in 3.17.0 CWE-94
TI-2017-14723 CVE-2017-1001003 · GHSA-pv8x-p9hq-j328

Improper input validation in math.js

Priority MEDIUM 45

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01689 Published 2017-11-27 Fixed in 3.17.0 CWE-88
TI-2026-29767 CVE-2026-41139 · GHSA-jvff-x2qm-6286

Unsafe array index getter in mathjs

Priority MEDIUM 41

Math.js is an extensive math library for JavaScript and Node.js.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.00577 Published 2026-05-07 Fixed in 15.2.0 CWE-915
TI-2026-29553 CVE-2026-40897 · GHSA-29qv-4j9f-fjw5

Math.js: Unsafe object property setter in mathjs

Priority MEDIUM 41

Math.js is an extensive math library for JavaScript and Node.js.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00551 Published 2026-04-24 Fixed in 15.2.0 CWE-915
TI-2020-06261 CVE-2020-7743 · GHSA-x2fc-mxcx-w4mf

Prototype pollution in mathjs

Priority LOW 39

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.03924 Published 2020-10-13 Partial fix · 7.5.1 CWE-1321
Open these records in search →