CVE-2026-40897 - Vulnerability Analysis

Overview

Math.js >= 13.1.1 and < 15.2.0 contains a command injection caused by unsafe evaluation in the expression parser, letting attackers execute arbitrary JavaScript code, exploit requires user to evaluate expressions.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript code, potentially leading to full system compromise or data theft.

Mitigation

Update to version 15.2.0 or later.

References

• https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad
• https://github.com/josdejong/mathjs/pull/3656
• https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner