diff --git a/HISTORY.md b/HISTORY.md index ec7c82108b..a74fd1bdc4 100644 --- a/HISTORY.md +++ b/HISTORY.md @@ -1,5 +1,18 @@ # History +# 2024-08-27, 13.1.1 + +- Fix security vulnerability in the CLI and web API allowing to call functions + `import`, `createUnit` and `reviver`, allowing to get access to the internal + math namespace and allowing arbitrary code execution. Thanks @StarlightPWN. +- Fix security vulnerability: when overwriting a `rawArgs` function with a + non-`rawArgs` function, it was still called with raw arguments. This was both + a functional issue and a security issue. Thanks @StarlightPWN. +- Fix security vulnerability: ensure that `ObjectWrappingMap` cannot delete + unsafe properties. Thanks @StarlightPWN. +- Fix: not being able to use methods and properties on arrays inside the + expression parser. + # 2024-08-26, 13.1.0 - Feat: support multiple inputs in function `map` (#3228, #3196). diff --git a/package-lock.json b/package-lock.json index f956362711..e21d464583 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "mathjs", - "version": "13.1.0", + "version": "13.1.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "mathjs", - "version": "13.1.0", + "version": "13.1.1", "license": "Apache-2.0", "dependencies": { "@babel/runtime": "^7.25.4", diff --git a/package.json b/package.json index 48dc88f245..676e77cbba 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "mathjs", - "version": "13.1.0", + "version": "13.1.1", "description": "Math.js is an extensive math library for JavaScript and Node.js. It features a flexible expression parser with support for symbolic computation, comes with a large set of built-in functions and constants, and offers an integrated solution to work with different data types like numbers, big numbers, complex numbers, fractions, units, and matrices.", "author": "Jos de Jong (https://github.com/josdejong)", "homepage": "https://mathjs.org", diff --git a/src/version.js b/src/version.js index e0267fb78b..0bf7d27c0e 100644 --- a/src/version.js +++ b/src/version.js @@ -1,3 +1,3 @@ -export const version = '13.1.0' +export const version = '13.1.1' // Note: This file is automatically generated when building math.js. // Changes made in this file will be overwritten.