Math.js Arbitrary Code Execution Vulnerability in Expression Parser

A vulnerability allowing the execution of arbitrary JavaScript has been identified in Math.js versions 13.1.0 prior to 15.2.0. This issue arises from the expression parser, which can be exploited in applications that allow users to evaluate arbitrary expressions using Math.js.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server or client side, depending on where Math.js is used.

Reproduction

The vulnerability can be reproduced by using a version of Math.js between 13.1.0 and 15.2.0, and evaluating an expression that exploits the issue, such as one that accesses and manipulates JavaScript objects or functions in a harmful way.

Remediation

Users can upgrade to Math.js version 15.2.0 or later to address this vulnerability.