What’s Vulnerable › Vulnerabilities

CVE-2026-40897: Math.js: Unsafe object property setter in mathjs

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-24 · updated 2026-10-26
• Weakness: CWE-915

Description

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

Affected products

• josdejong mathjs: from 13.1.1 before 15.2.0 — fixed in 15.2.0

How to fix

Upgrade to a fixed version: josdejong mathjs 15.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad
• https://github.com/josdejong/mathjs/pull/3656
• https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5
• https://access.redhat.com/security/cve/CVE-2026-40897
• https://bugzilla.redhat.com/show_bug.cgi?id=2461612
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40897.json

Get alerted when CVE-2026-40897 or the next vulnerability affects your stack