Arbitrary Code Execution

Affecting mathjs package, versions <3.13.3

Overview

mathjs is an extensive math library for JavaScript and Node.js.

Affected versions of the package are vulnerable to Arbitrary Code Execution. The isSafeMethod was able to call other methods (like bind) which is not allowed and could cause code execution on the remote server.

Remediation

Upgrade mathjs to version 3.13.3 or higher.

References

• GitHub Changelog
• GitHub Commit