What is the CVSS score of CVE-2026-41139?

CVE-2026-41139 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Math.js are affected by CVE-2026-41139?

Math.js versions 13.1.0 through 15.1.x contain a remote code execution vulnerability in the expression parser that allows authenticated attackers to execute arbitrary JavaScript code through crafted…. A patch is available.

How to fix or mitigate CVE-2026-41139?

Within 24 hours: Inventory all applications and dependencies using Math.js versions 13.1.0-15.1.x; verify exposure to user-supplied mathematical expressions. Within 7 days: Upgrade to Math.js version 15.2.0 or later across all production and development environments. Within 30 days: Conduct code review of all Math.js expression parsing implementations to identify and remediate instances processing untrusted input; consider implementing input validation and sandboxing as defense-in-depth measures.

Math.js CVE-2026-41139

EUVD-2026-28310 HIGH

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2026-05-07 GitHub_M

GHSA-jvff-x2qm-6286

Node.js Information Disclosure Mathjs

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 07, 2026 - 05:46 vuln.today

Analysis Generated

May 07, 2026 - 05:46 vuln.today

CVE Published

May 07, 2026 - 05:06 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

21 npm packages depend on mathjs (2 direct, 19 indirect)

Ecosystem-wide dependent count for version 13.1.0.

DescriptionCVE.org

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

AnalysisAI

Remote code execution in Math.js expression parser allows authenticated attackers to execute arbitrary JavaScript code in versions 13.1.0 through 15.1.x. The vulnerability stems from unsafe property access controls (CWE-915) that can be exploited via crafted mathematical expressions. Patched in version 15.2.0 with comprehensive property access validation (commit bcf0da4, PR #3656). No active exploitation confirmed by CISA KEV, but public patch code reveals exploitable attack surface involving prototype pollution or unsafe property traversal. CVSS 8.8 with network vector and low complexity indicates high real-world risk for applications exposing Math.js parsing to user input.

Technical ContextAI

Math.js is a widely-used JavaScript mathematical expression parser and computation library for Node.js and browser environments (cpe:2.3:a:josdejong:mathjs). The vulnerability maps to CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as prototype pollution or unsafe property access. The GitHub PR diff reveals the root cause: insufficient validation in property access functions (getSafeProperty, setSafeProperty, isSafeProperty in src/utils/customs.js) allowed attackers to access or modify dangerous properties like __proto__, constructor, or prototype on Objects and Arrays. The fix introduces strict separation between isSafeObjectProperty (blocks inheritance from Object.prototype) and isSafeArrayProperty (restricts to numeric indices and 'length'), plus explicit type checking to prevent non-array index manipulation. Additional hardening in src/utils/array.js validates array indices. This class of vulnerability is critical in expression parsers that evaluate user-controlled input, as it can bypass sandboxing to achieve arbitrary code execution through JavaScript's prototype chain.

RemediationAI

Upgrade Math.js to version 15.2.0 or later immediately (https://github.com/josdejong/mathjs/releases/tag/v15.2.0). Apply via npm/yarn: 'npm install mathjs@15.2.0' or 'yarn upgrade mathjs@15.2.0'. The fix is implemented in commits bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 and 0aee2f61866e35ffa0aef915221cdf6b026ffdd4 (PR #3656 at https://github.com/josdejong/mathjs/pull/3656). If upgrade is not immediately feasible, implement strict input validation to reject expressions containing '__proto__', 'constructor', 'prototype', or bracket notation property access before passing to Math.js parser. Deploy this as a temporary workaround layer - note that blocklists are fragile and may be bypassed via encoding or parser quirks, so upgrade remains mandatory. For applications where Math.js is only used for trusted internal calculations (no user input), risk is lower but upgrade still recommended as defense-in-depth. Review application logs for anomalous mathematical expressions that may indicate exploitation attempts (e.g., expressions containing prototype chain keywords or unexpected property access patterns).