CVE-2026-40897
Unsafe object property setter in mathjs
Description
### Impact This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. ### Patches The issue was introduced in mathjs `v13.1.1`, and patched in mathjs `v15.2.0`. ### Workarounds There is no workaround without upgrading to `v15.2.0`. ### References You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad (part of PR https://github.com/josdejong/mathjs/pull/3656).
How to fix CVE-2026-40897
To remediate CVE-2026-40897, upgrade the affected package to a fixed version below.
- —upgrade to 15.2.0 or later
Is CVE-2026-40897 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 13.1.1, < 15.2.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |