math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
CVSS 3.0CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.01689·Published 2017-11-27·Fixed in 3.17.0CWE-88