PT-2026-33384 · Josdejong+2 · Math.Js

Jos De Jong + 1 · Published 2026-04-16 · Updated 2026-05-19 · CVE-2026-40897

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Math.js versions 13.1.1 through 15.1.x

Description An issue in the expression parser allows the execution of arbitrary JavaScript. This occurs in applications where users are permitted to evaluate arbitrary expressions using the mathjs expression parser.

Recommendations Update to version 15.2.0.

Fix

RCE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-40897

GHSA-29QV-4J9F-FJW5

Affected Products

Math.Js

References · 8

• https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5 · Vendor Advisory
• https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40897 · Security Note
• https://osv.dev/vulnerability/GHSA-29qv-4j9f-fjw5 · Vendor Advisory
• https://github.com/josdejong/mathjs/pull/3656 · Note
• https://github.com/josdejong/mathjs · Note
• https://twitter.com/CVEnew/status/2047731894519783670 · Twitter Post
• https://twitter.com/EQSTLab/status/2056613753412858309 · Twitter Post