Executive brief
mathjs is a popular JavaScript math library used in web applications to evaluate mathematical expressions. This vulnerability allows attackers to execute arbitrary JavaScript code through the expression parser when applications allow users to input or evaluate untrusted expressions. An attacker could gain full control over the application, steal sensitive data, or compromise the underlying system.
Technical details
The vulnerability exists in mathjs's expression parser and is classified as an improperly controlled modification of dynamically-determined object attributes (CWE-915). The root cause is an unsafe implementation of the internal `setSafeProperty` function that failed to properly restrict which object properties could be set during expression evaluation. The vulnerable component's `setSafeProperty` function allowed setting arbitrary properties on objects and arrays beyond the intended numeric indices and `length` property, enabling prototype pollution or arbitrary property mutation that leads to code execution. An attacker needs low privileges (ability to provide expressions to the parser) and no user interaction to exploit this. The fix restricts property setting to only safe numeric indices on arrays and specific safe properties on objects. Patches are available in mathjs v15.2.0 and later.
Affected products
- Jos de Jong mathjs 13.1.1 to 15.1.x
Timeline
- 2026-04-16: disclosed: Advisory GHSA-29qv-4j9f-fjw5 published
- 2026-04-02: patched: Fix merged in PR #3656 (commit 513ab2a)
- 2026-04-07: other: Fix merged to develop branch