PT-2026-38340 · Npm · Math.Js

Cykutw · Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-41139

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Math.js versions 13.1.0 through 15.1.x

Description Arbitrary JavaScript can be executed through the expression parser of the library.

Recommendations Update to version 15.2.0.

Fix

RCE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-41139

Affected Products

Math.Js

References · 13

• https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 · Patch
• https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 · Patch
• https://github.com/josdejong/mathjs/pull/3656 · Patch
• https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41139 · Security Note
• https://github.com/josdejong/mathjs/releases/tag/v15.2.0 · Note
• https://reddit.com/r/pwnhub/comments/1t6alpr/highseverity_vulnerability_in_mathjs_exposes · Reddit Post
• https://twitter.com/CVEnew/status/2052400807581258014 · Twitter Post
• https://twitter.com/SelvaKtm2/status/2052815085794636073 · Twitter Post
• https://twitter.com/VigneshVic23698/status/2052965574586872177 · Twitter Post
• https://t.me/cveNotify/162753 · Telegram Post
• https://t.me/CVEtracker/52947 · Telegram Post
• https://twitter.com/cybrsecpath/status/2053428999838413183 · Twitter Post