An improper control of dynamically-determined object attributes vulnerability in mathjs affects versions 13.1.0 through 15.1.x, allowing low-privileged attackers to achieve arbitrary code execution.

This flaw involves CWE-915, allowing the improper modification of dynamically-determined object attributes within the expression parser. Low-privileged attackers can leverage this mechanism to execute arbitrary JavaScript code with network attack vector complexity.

A successful exploit grants an attacker the ability to execute arbitrary code within the context of the running Node.js or JavaScript environment. This can lead to complete system compromise, data exfiltration, or service disruption. The CVSS score of 8.8 reflects the high severity of total confidentiality, integrity, and availability impact.

Immediate Action: Update the mathjs package to version 15.2.0 or later to resolve the vulnerability.

Proactive Monitoring: Monitor application logs for unusual expression evaluations or unauthorized access attempts targeting Node.js execution routines.

Compensating Controls: Implement strict input sanitization and expression validation rules at the application layer to restrict parser capabilities if immediate patching is not possible.

Public Exploit Available: No

Organizations utilizing the mathjs library must treat this high-severity advisory with urgency. Administrators should immediately upgrade to version 15.2.0 to eliminate the risk of arbitrary JavaScript execution and secure the underlying application environment.