### [CVE-2017-1001003](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1001003)
![](https://img.shields.io/static/v1?label=Product&message=math.js&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=3.17.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-88%3A%20Argument%20Injection%20or%20Modification&color=brightgreen)

### Description

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.

### POC

#### Reference
- https://github.com/josdejong/mathjs/blob/master/HISTORY.md#2017-11-18-version-3170

#### Github
- https://github.com/ARPSyndicate/cvemon