Executive brief
Math.js, a popular mathematics library for JavaScript and Node.js, contains a vulnerability in its expression parser. An attacker can exploit this to execute unauthorized code on the system where the library is running. This could lead to full system compromise, data theft, or service disruption.
Technical details
A code injection vulnerability exists in Math.js versions 13.1.0 to 15.2.0 due to improper validation in the expression parser. The flaw involves CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and CWE-94 (Improper Control of Generation of Code). Specifically, the internal `setSafeProperty` function failed to sufficiently restrict property modifications on arrays, and the `.get()` method did not properly validate that the `index` parameter was an array. An attacker with the ability to provide expressions to the parser can achieve arbitrary JavaScript execution. The issue is patched in version 15.2.0.
Affected products
- josdejong mathjs >= 13.1.0, < 15.2.0
Timeline
- 2026-04-07: patched: Fixes committed to repository
- 2026-05-07: advisory: CVE published
References
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
- https://github.com/josdejong/mathjs/pull/3656
- https://github.com/josdejong/mathjs/releases/tag/v15.2.0
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
- https://access.redhat.com/security/cve/CVE-2026-41139
- https://bugzilla.redhat.com/show_bug.cgi?id=2467648