CVEvulnerability

CVE-2026-41139

8.8 HIGH Published 2026-05-07 Modified 2026-10-26 Official page ↗
Status
Modified
Published
2026-05-07
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-915, CWE-94

Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Affected configurations

• mathjs mathjs (>= 13.1.0 < 15.2.0)

Related

Weakness · CWE (2)

  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness
  • CWE-94 Improper Control of Generation of Code weakness

References