← Vulnerability feed

Vulnerability record · CVE-2026-40897 · published 24 April 2026

CVE-2026-40897: Mathjs mass assignment vulnerability

Mathjs · Mathjs

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

8.8 CVSS 3.1 High EPSS 0.76% · top 46.5% CWE-915 · Mass assignmentCWE-917 · Expression language injection
8.8CVSS 3.1 base score
0.76%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
15 Jul 2026Last modified by NVD

Description

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad Patch
https://github.com/josdejong/mathjs/pull/3656 Issue Tracking
https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-40897
https://bugzilla.redhat.com/show_bug.cgi?id=2461612
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40897.json

Track CVE-2026-40897 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-41139Mathjs mass assignment vulnerabilityMath.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed v…EPSS 0.80%7.3CVE-2020-7743Mathjs prototype pollution vulnerabilityThe package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.EPSS 3.9%

Source: NIST National Vulnerability Database (record CVE-2026-40897), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.