← Vulnerability feed

Vulnerability record · CVE-2026-41139 · published 7 May 2026

CVE-2026-41139: Mathjs mass assignment vulnerability

Mathjs · Mathjs

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

8.8 CVSS 3.1 High EPSS 0.80% · top 45.3% CWE-915 · Mass assignmentCWE-94 · Code injection
8.8CVSS 3.1 base score
0.80%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
15 Jul 2026Last modified by NVD

Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 Patch
https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 Patch
https://github.com/josdejong/mathjs/pull/3656 Issue TrackingPatch
https://github.com/josdejong/mathjs/releases/tag/v15.2.0 Release Notes
https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g PatchVendor Advisory
https://access.redhat.com/security/cve/CVE-2026-41139
https://bugzilla.redhat.com/show_bug.cgi?id=2467648
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json

Track CVE-2026-41139 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-40897Mathjs mass assignment vulnerabilityMath.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript…EPSS 0.76%7.3CVE-2020-7743Mathjs prototype pollution vulnerabilityThe package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.EPSS 3.9%

Source: NIST National Vulnerability Database (record CVE-2026-41139), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.