CVE-2026-41139: Unsafe array index getter in mathjs

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-07 · updated 2026-10-26
Weakness: CWE-915

Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Affected products

josdejong mathjs: from 13.1.0 before 15.2.0 — fixed in 15.2.0

How to fix

Upgrade to a fixed version: josdejong mathjs 15.2.0. Check the vendor advisory for mitigations.

References

https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
https://github.com/josdejong/mathjs/pull/3656
https://github.com/josdejong/mathjs/releases/tag/v15.2.0
https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
https://access.redhat.com/security/cve/CVE-2026-41139
https://bugzilla.redhat.com/show_bug.cgi?id=2467648
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json

Get alerted when CVE-2026-41139 or the next vulnerability affects your stack