VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Nov 27, 2017· Updated Jun 17, 2026

CVE-2017-1001003

CVE-2017-1001003

Description

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mathjsnpm
< 3.17.03.17.0

Affected products

3
  • Mathjs/Math.js
    cpe:2.3:a:mathjs_project:mathjs:*:*:*:*:*:*:*:*
    Range: <3.17.0
  • ghsa-coords
    pkg:npm/mathjs
    Range: < 3.17.0
  • math.js/math.jsv5
    Range: 3.17.0

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.