CVE-2026-40897
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Math.js library for JavaScript and Node.js versions 13.1.1 through 15.2.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
Risk Assessment
An attacker can remotely execute arbitrary JavaScript code on the server or in the user's browser, leading to full application compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update the math.js library to version 15.2.0 or later. If an update is not possible, restrict access to the expression parser to trusted users only.
Other vulnerabilities in math.js
See all- CVE-2017-1001003Critical
math.js versions before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
- CVE-2017-1001002Critical
math.js versions before 3.17.0 have an arbitrary code execution vulnerability in the JavaScript engine. Creating a typed function with JavaScript code in the name could lead to unauthorized code execution.
- CVE-2026-41139High
The math.js library for JavaScript and Node.js versions 13.1.0 through 15.1.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
Original NVD description (English source)
Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.