Executive brief
mathjs is a JavaScript mathematics library used in web applications and data processing workflows. A prototype pollution vulnerability in the configuration update mechanism allows attackers to modify core JavaScript object properties, potentially leading to unexpected application behavior, denial of service, or information disclosure depending on how the affected application uses the library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-915) in the deepExtend function called during mathjs configuration updates. The vulnerability allows an attacker to inject properties into JavaScript's Object prototype by crafting malicious configuration payloads. No authentication or special privileges are required; the attack can be triggered remotely via network if the application exposes configuration update functionality. An attacker can pollute the prototype to corrupt application state, bypass security checks, or cause denial of service. The vulnerability was patched in version 7.5.1 via commit ecb8051, which adds proper validation to prevent prototype pollution during object extension.
Affected products
- mathjs mathjs before 7.5.1
Timeline
- 2020-10-13: disclosed: CVE-2020-7743 published on NVD
- 2020-10-10: patched: Version 7.5.1 released with fix
- 2021-05-10: advisory: GHSA-x2fc-mxcx-w4mf published