CVE-2026-41139

Unsafe array index getter in mathjs

8.8 HighFix available

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.58%Up 0.5 points since May 7, 2026

What each source reports

CVE List 8.8

Unsafe array index getter in mathjs

Record: CVE-2026-41139
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915, CWE-94
Updated: 2026-11-02

EUVDEUVD-2026-28310 8.8

Record: EUVD-2026-28310
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jvff-x2qm-6286 8.8

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

Impact

This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Patches

The issue was introduced in mathjs v13.1.0, and patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading to v15.2.0.

References

You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/24d5ee7e25e85d49619b09122f055db4139bc057 (part of PR https://github.com/josdejong/mathjs/pull/3656).

Record: GHSA-jvff-x2qm-6286
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

NVD 8.8

Record: CVE-2026-41139
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915, CWE-94
Updated: 2026-11-02

OSV 8.8

Unsafe array index getter in mathjs

Record: CVE-2026-41139
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

OSVGHSA-jvff-x2qm-6286 8.8

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

Impact

Patches

The issue was introduced in mathjs v13.1.0, and patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading to v15.2.0.

References

You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/24d5ee7e25e85d49619b09122f055db4139bc057 (part of PR https://github.com/josdejong/mathjs/pull/3656).

Record: GHSA-jvff-x2qm-6286
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-915
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mathjs` npm	13.1.0 up to 15.2.0	15.2.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41139 is a high vulnerability (CVSS 8.8) in Josdejong Mathjs, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in mathjs 15.2.0.

References

Show 7 moreShow less