Arbitrary JavaScript Execution Vulnerability in Math.js Library by Jos De Jong
CVE-2026-41139

8.8HIGH

Key Information:

Vendor: Josdejong
Status: Mathjs
Vendor: CVE Published:; 7 May 2026

What is CVE-2026-41139?

The Math.js library, popular for its extensive math capabilities in JavaScript and Node.js, has been found to contain a vulnerability that allows for the execution of arbitrary JavaScript code via its expression parser. This issue affects all versions from 13.1.0 up to, but not including, version 15.2.0. Users are encouraged to upgrade to the patched version 15.2.0 to mitigate this security risk.