# CVE-2026-41139: josdejong mathjs arbitrary code execution in expression parser

Source: https://junglewise.ai/threats/cve-2026-41139-josdejong-mathjs-arbitrary-code-execution-in-expression-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-41139 · Severity: high · CVSS 8.8 · Published 2026-05-07

Math.js, a popular mathematics library for JavaScript and Node.js, contains a vulnerability in its expression parser. An attacker can exploit this to execute unauthorized code on the system where the library is running. This could lead to full system compromise, data theft, or service disruption.

Technologies: [Jos de Jong Math.Js](https://junglewise.ai/threats/technologies/math-js), [mathjs (npm)](https://junglewise.ai/threats/technologies/mathjs). Vendors: [Jos de Jong](https://junglewise.ai/threats/vendors/jos-de-jong), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41139 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41139 being exploited in the wild.

**How severe is CVE-2026-41139?** High severity, with a CVSS score of 8.8, published 7 May 2026.

**Which products and versions are affected?** Jos de Jong Math.Js >= 13.1.0, < 15.2.0; mathjs (npm) SEMVER:introduced=13.1.0,fixed=15.2.0.

**Is there a fix for CVE-2026-41139?** Yes. mathjs (npm): upgrade to 15.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41139 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41139?** Check whether you run Jos de Jong Math.Js or mathjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mathjs (npm): upgrade to 15.2.0 or later

  ```sh
  npm install mathjs@15.2.0
  ```


## Technical details

A code injection vulnerability exists in Math.js versions 13.1.0 to 15.2.0 due to improper validation in the expression parser. The flaw involves CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and CWE-94 (Improper Control of Generation of Code). Specifically, the internal `setSafeProperty` function failed to sufficiently restrict property modifications on arrays, and the `.get()` method did not properly validate that the `index` parameter was an array. An attacker with the ability to provide expressions to the parser can achieve arbitrary JavaScript execution. The issue is patched in version 15.2.0.

## Affected products

- josdejong mathjs >= 13.1.0, < 15.2.0

## Identifiers

- CVE-2026-41139
- GHSA-jvff-x2qm-6286

## Timeline

- 2026-04-07: patched: Fixes committed to repository
- 2026-05-07: advisory: CVE published

## References

- [https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4](https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4)
- [https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611](https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611)
- [https://github.com/josdejong/mathjs/pull/3656](https://github.com/josdejong/mathjs/pull/3656)
- [https://github.com/josdejong/mathjs/releases/tag/v15.2.0](https://github.com/josdejong/mathjs/releases/tag/v15.2.0)
- [https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g](https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g)
- [https://access.redhat.com/security/cve/CVE-2026-41139](https://access.redhat.com/security/cve/CVE-2026-41139)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2467648](https://bugzilla.redhat.com/show_bug.cgi?id=2467648)

## Related threats

- [josdejong mathjs arbitrary code execution in expression parser](https://junglewise.ai/threats/cve-2026-40897-josdejong-mathjs-arbitrary-code-execution-in-expression-parser)
- [mathjs prototype pollution in deepExtend](https://junglewise.ai/threats/cve-2020-7743-mathjs-prototype-pollution-in-deepextend)
- [mathjs arbitrary code execution via unicode property bypass](https://junglewise.ai/threats/cve-2017-1001003-mathjs-arbitrary-code-execution-via-unicode-property-bypass)
- [math.js arbitrary code execution in typed function](https://junglewise.ai/threats/cve-2017-1001002-math-js-arbitrary-code-execution-in-typed-function)