CVE-2026-40897: josdejong mathjs arbitrary code execution in expression parser

CVE-2026-40897 · Severity: high · CVSS 8.8 · Published 2026-04-24

mathjs is a popular JavaScript math library used in web applications to evaluate mathematical expressions. This vulnerability allows attackers to execute arbitrary JavaScript code through the expression parser when applications allow users to input or evaluate untrusted expressions. An attacker could gain full control over the application, steal sensitive data, or compromise the underlying system.

Technologies: mathjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-40897 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40897 being exploited in the wild.
How severe is CVE-2026-40897?
High severity, with a CVSS score of 8.8, published 24 April 2026.
Which products and versions are affected?
mathjs (npm) >= 13.1.1, < 15.2.0, SEMVER:introduced=13.1.1,fixed=15.2.0.
Is there a fix for CVE-2026-40897?
Yes. mathjs (npm): upgrade to 15.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40897 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40897?
Check whether you run mathjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mathjs (npm): upgrade to 15.2.0 or later
    npm install mathjs@15.2.0

Technical details

The vulnerability exists in mathjs's expression parser and is classified as an improperly controlled modification of dynamically-determined object attributes (CWE-915). The root cause is an unsafe implementation of the internal `setSafeProperty` function that failed to properly restrict which object properties could be set during expression evaluation. The vulnerable component's `setSafeProperty` function allowed setting arbitrary properties on objects and arrays beyond the intended numeric indices and `length` property, enabling prototype pollution or arbitrary property mutation that leads to code execution. An attacker needs low privileges (ability to provide expressions to the parser) and no user interaction to exploit this. The fix restricts property setting to only safe numeric indices on arrays and specific safe properties on objects. Patches are available in mathjs v15.2.0 and later.

Affected products

  • Jos de Jong mathjs 13.1.1 to 15.1.x

Identifiers

  • CVE-2026-40897
  • GHSA-29qv-4j9f-fjw5

Timeline

  • 2026-04-16: disclosed: Advisory GHSA-29qv-4j9f-fjw5 published
  • 2026-04-02: patched: Fix merged in PR #3656 (commit 513ab2a)
  • 2026-04-07: other: Fix merged to develop branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.