Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 Patch
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 Patch
- https://github.com/josdejong/mathjs/pull/3656 Issue Tracking, Patch
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 8.8 · mathjsNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:*
References 8
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 Patch
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 Patch
- https://github.com/josdejong/mathjs/pull/3656 Issue Tracking, Patch
- https://github.com/josdejong/mathjs/releases/tag/v15.2.0 Release Notes
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g Patch, Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-41139
- https://bugzilla.redhat.com/show_bug.cgi?id=2467648
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json