CVE-2026-41139 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: May 7, 2026
Math.js - Command Injection
Published: May 7, 2026Updated: May 7, 2026Remote Exploitable
Overview
Math.js >= 13.1.0 and < 15.2.0 contains a command injection caused by arbitrary JavaScript execution via the expression parser, letting attackers execute arbitrary code remotely, exploit requires crafted input.
Severity & Score
Severity: High
CVSS Score: 8.8
Impact
Attackers can execute arbitrary JavaScript code remotely, potentially leading to full system compromise.
Mitigation
Upgrade to version 15.2.0 or later.
References
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
- https://github.com/josdejong/mathjs/pull/3656
- https://github.com/josdejong/mathjs/releases/tag/v15.2.0
Related Resources
Details
- CVE ID
- CVE-2026-41139
- Severity
- High
- CVSS Score
- 8.8
- Type
- command_injection
- Status
- new
CWE
- CWE-915
CVSS Metrics
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H