All the vulnerabilities related to the version 0.25.0 of the package
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
Upgrade to version 3.17.0 or later.
Arbitrary Code Execution in mathjs
math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.
Update to version 3.17.0 or later.
Prototype Pollution in mathjs
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.