CVE-2026-41139
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The math.js library for JavaScript and Node.js versions 13.1.0 through 15.1.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
Risk Assessment
An attacker can remotely execute arbitrary JavaScript code in the application context, potentially leading to server compromise, data theft, or other unauthorized actions.
Recommendation
Immediately update math.js to version 15.2.0 or later. If updating is not possible, restrict access to the expression parser to only trusted input.
Other vulnerabilities in math.js
See all- CVE-2017-1001003Critical
math.js versions before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.
- CVE-2017-1001002Critical
math.js versions before 3.17.0 have an arbitrary code execution vulnerability in the JavaScript engine. Creating a typed function with JavaScript code in the name could lead to unauthorized code execution.
- CVE-2026-40897High
Math.js library for JavaScript and Node.js versions 13.1.1 through 15.2.0 contains a vulnerability allowing arbitrary JavaScript execution via the expression parser. The issue is fixed in version 15.2.0.
Original NVD description (English source)
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.