CVE-2020-7743 | BDVDB-2026-142849 Detail
mathjs
Description#
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact low. Attack vector: network.
Weaknesses#
No weakness recorded in the source data.
References#
- https://snyk.io/vuln/SNYK-JS-MATHJS-1016401
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1017111
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1017112
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1017113
- https://github.com/josdejong/mathjs/blob/develop/src/utils/object.js%23L82
- https://github.com/josdejong/mathjs/commit/ecb80514e80bce4e6ec7e71db8ff79954f07c57e
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.