Is CVE-2026-41139 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41139 being exploited in the wild.

How severe is CVE-2026-41139?

High severity, with a CVSS score of 8.8, published 7 May 2026.

Which products and versions are affected?

Jos de Jong Math.Js >= 13.1.0, < 15.2.0; mathjs (npm) SEMVER:introduced=13.1.0,fixed=15.2.0.

Is there a fix for CVE-2026-41139?

Yes. mathjs (npm): upgrade to 15.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41139 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41139?

Check whether you run Jos de Jong Math.Js or mathjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41139: josdejong mathjs arbitrary code execution in expression parser

Q: Is there a fix for CVE-2026-41139?

Yes. mathjs (npm): upgrade to 15.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41139 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-41139?

Check whether you run Jos de Jong Math.Js or mathjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41139 · Severity: high · CVSS 8.8 · Published 2026-05-07

Math.js, a popular mathematics library for JavaScript and Node.js, contains a vulnerability in its expression parser. An attacker can exploit this to execute unauthorized code on the system where the library is running. This could lead to full system compromise, data theft, or service disruption.

Technologies: Jos de Jong Math.Js, mathjs (npm). Vendors: Jos de Jong, npm.

Quick answers

Is CVE-2026-41139 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41139 being exploited in the wild.
How severe is CVE-2026-41139?: High severity, with a CVSS score of 8.8, published 7 May 2026.
Which products and versions are affected?: Jos de Jong Math.Js >= 13.1.0, < 15.2.0; mathjs (npm) SEMVER:introduced=13.1.0,fixed=15.2.0.
Is there a fix for CVE-2026-41139?: Yes. mathjs (npm): upgrade to 15.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41139 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41139?: Check whether you run Jos de Jong Math.Js or mathjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mathjs (npm): upgrade to 15.2.0 or later
```
npm install mathjs@15.2.0
```

Technical details

A code injection vulnerability exists in Math.js versions 13.1.0 to 15.2.0 due to improper validation in the expression parser. The flaw involves CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and CWE-94 (Improper Control of Generation of Code). Specifically, the internal `setSafeProperty` function failed to sufficiently restrict property modifications on arrays, and the `.get()` method did not properly validate that the `index` parameter was an array. An attacker with the ability to provide expressions to the parser can achieve arbitrary JavaScript execution. The issue is patched in version 15.2.0.

Affected products

josdejong mathjs >= 13.1.0, < 15.2.0

Identifiers

CVE-2026-41139
GHSA-jvff-x2qm-6286

Timeline

2026-04-07: patched: Fixes committed to repository
2026-05-07: advisory: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.