PT-2026-38340 · Npm · Math.Js

Cykutw · Published 2026-04-10 · Updated 2026-05-10 · CVE-2026-41139

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Math.js versions 13.1.0 through 15.1.x

Description Arbitrary JavaScript can be executed through the expression parser of the library.

Recommendations Update to version 15.2.0.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-915

CWE-94

Related Identifiers

CVE-2026-41139

GHSA-5V89-RWGR-QJ6G

GHSA-JVFF-X2QM-6286

Affected Products

Math.Js

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41139.json · Exploit
• https://github.com/josdejong/mathjs/pull/3656 · Patch
• https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 · Patch
• https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 · Patch
• https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jvff-x2qm-6286 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41139 · Security Note
• https://github.com/josdejong/mathjs/releases/tag/v15.2.0 · Note
• https://github.com/josdejong/mathjs/security/advisories/GHSA-jvff-x2qm-6286 · Note
• https://github.com/josdejong/mathjs · Note
• https://twitter.com/cybrsecpath/status/2053428999838413183 · Twitter Post
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json · Note
• https://reddit.com/r/pwnhub/comments/1t6alpr/highseverity_vulnerability_in_mathjs_exposes · Reddit Post
• https://t.me/CVEtracker/52947 · Telegram Post