CVE-2020-7743

Description

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

How to fix CVE-2020-7743

To remediate CVE-2020-7743, upgrade the affected package to a fixed version below.

• npm/mathjs—upgrade to 7.5.1 or later

Is CVE-2020-7743 being exploited?

Low — EPSS is 1.7%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 7.5.1

CVSS scores

References (9)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-7743
• WEBgithub.com/josdejong/mathjs/blob/develop/HISTORY.md#2020-10-10-version-751
• WEBgithub.com/josdejong/mathjs/blob/develop/src/utils/object.js%23L82
• WEBgithub.com/josdejong/mathjs/commit/ecb80514e80bce4e6ec7e71db8ff79954f07c57e