VulnerabilityModified
CVE-2026-41139
From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs.
HIGH 8.8EPSS 0.58%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-915, CWE-94
- Affected
- mathjs/mathjs
- Source
- security-advisories@github.com
References
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4Patch
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611Patch
- https://github.com/josdejong/mathjs/pull/3656Issue Tracking, Patch
- https://github.com/josdejong/mathjs/releases/tag/v15.2.0Release Notes
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6gPatch, Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-41139
- https://bugzilla.redhat.com/show_bug.cgi?id=2467648
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.