CVE-2026-40897

Math.js: Unsafe object property setter in mathjs

Published Apr 24, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-29qv-4j9f-fjw5 Unsafe object property setter in mathjs
History
Type Values Removed Values Added
First Time appeared Josdejong
Josdejong mathjs
Vendors & Products Josdejong
Josdejong mathjs
Type Values Removed Values Added
First Time appeared Mathjs
Mathjs mathjs
CPEs cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:*
Vendors & Products Mathjs
Mathjs mathjs
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.
Title Math.js: Unsafe object property setter in mathjs
Weaknesses CWE-915
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Jul 15, 2026, 1:00 AM
Reserved
Apr 15, 2026, 4:37 PM
Status
Modified
Published
Apr 24, 2026, 5:16 PM
Modified
Oct 26, 2026, 9:10 PM
Severity
Important
Public date
Apr 24, 2026, 4:48 PM