CVE-2026-41139
Math.js is an extensive math library for JavaScript and Node.js.
Published May 7, 2026 · updated Jul 15, 2026 · mathjs mathjs
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 7, 2026 · NIST NVD
Detected
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
Jul 15, 2026 · NIST NVD
Updated
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
Affected
- cpe mathjs/mathjsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41139
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41139
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
nvd.nist.gov