Global infos:

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

CVE Status: Modified

References:

46fe6300-5254-4a98-9594-a9567bec8179

46fe6300-5254-4a98-9594-a9567bec8179

af854a3a-2127-422b-91ae-364da2661108

af854a3a-2127-422b-91ae-364da2661108

Metrics:

No CVSS data available

Links:

Exploit-db
Github