What is the CVSS score of CVE-2026-40897?

CVE-2026-40897 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of mathjs are affected by CVE-2026-40897?

The mathjs npm library (versions 13.1.1 through 15.1.x) contains a sandbox escape vulnerability that allows arbitrary code execution on systems processing untrusted mathematical expressions.. A patch is available.

Is there a public PoC exploit available for CVE-2026-40897?

Yes, a public proof-of-concept exploit is available for CVE-2026-40897. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-40897?

Within 24 hours, inventory all applications and transitive dependencies using mathjs and document current versions in production. Within 7 days, upgrade all affected instances to mathjs 15.2.0 or later, prioritizing production systems and those accepting user-supplied or third-party expressions. Within 30 days, validate patches across all environments, review application logs for suspicious mathematical expression submissions predating the patch, and confirm no exploitation attempts are present.

mathjs CVE-2026-40897

HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-04-16 https://github.com/josdejong/mathjs

GHSA-29qv-4j9f-fjw5

Information Disclosure

8.8

CVSS 3.1 · Vendor: https://github.com/josdejong/mathjs

Severity by source

Vendor (https://github.com/josdejong/mathjs) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable parser input with low complexity and no interaction yields total impact via arbitrary JS; PR:L reflects typical application-gated access to the evaluation feature rather than guaranteed anonymous exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (https://github.com/josdejong/mathjs).

CVSS VectorVendor: https://github.com/josdejong/mathjs

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:16 vuln.today

Analysis Generated

Jul 24, 2026 - 07:16 vuln.today

PoC Detected

Apr 27, 2026 - 14:47 vuln.today

Public exploit code

Patch released

Apr 16, 2026 - 22:45 nvd

Patch available

CVE Published

Apr 16, 2026 - 22:38 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

24 npm packages depend on mathjs (5 direct, 20 indirect)

Ecosystem-wide dependent count for version 13.1.1.

DescriptionCVE.org

Impact

This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Patches

The issue was introduced in mathjs v13.1.1, and patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading to v15.2.0.

References

You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad (part of PR https://github.com/josdejong/mathjs/pull/3656).

AnalysisAI

Arbitrary JavaScript execution in the mathjs (npm) expression parser lets an attacker who can submit expressions escape the math sandbox and run code in the host JavaScript runtime. It affects mathjs versions >= 13.1.1 and < 15.2.0 and stems from an unsafe object/array property setter that failed to block dangerous properties. Publicly available exploit code exists (a proof-of-concept gist), but there is no evidence of active exploitation; EPSS is only 0.05% (16th percentile), consistent with the CISA SSVC exploitation status of 'none'.

Technical ContextAI

mathjs is a widely used JavaScript/TypeScript math library whose expression parser (math.evaluate / the compiled expression tree) is designed as a sandbox that safely evaluates user-supplied mathematical expressions. The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The GHSA advisory titles it an 'Unsafe object property setter': the internal getSafeProperty/setSafeProperty guards in src/utils/customs.js relied on a single isSafeProperty check that, for arrays, did not adequately restrict which property names could be read or written. The fix (PR #3656, commit 513ab2a) splits the check into isSafeObjectProperty (plain objects, rejecting anything present on Object.prototype) and a new isSafeArrayProperty that only permits numeric/integer indices and 'length', and adds an Array.isArray guard in stretch(). The affected package is identified by CPE pkg:npm/mathjs. Because mathjs runs in-process, escaping the expression sandbox yields execution in the surrounding Node.js/browser JavaScript context.

RemediationAI

Vendor-released patch: upgrade mathjs to v15.2.0 or later; the vendor explicitly states there is no workaround without upgrading. Apply the update via your package manager (for example, bump the mathjs dependency to ^15.2.0 and rebuild/redeploy), and check transitive dependencies since mathjs is frequently pulled in indirectly. If you cannot upgrade immediately, the only effective compensating control is to stop passing untrusted input to the parser: disable or gate any feature that lets end users submit arbitrary mathjs expressions, or restrict expression evaluation to trusted/authenticated operators only - accepting the trade-off that user-facing calculator/formula functionality is lost. Do not rely on string-based input filtering of expressions as a durable control, since the bypass operates through property-access semantics rather than obvious keywords. Advisory and fix references: https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5, https://github.com/josdejong/mathjs/pull/3656, and the fixing commit https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad.