CVE-2026-41139

Description

### Impact This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. ### Patches The issue was introduced in mathjs `v13.1.0`, and patched in mathjs `v15.2.0`. ### Workarounds There is no workaround without upgrading to `v15.2.0`. ### References You can find out more via the commit fixing this issue: https://github.com/josdejong/mathjs/commit/24d5ee7e25e85d49619b09122f055db4139bc057 (part of PR https://github.com/josdejong/mathjs/pull/3656).

How to fix CVE-2026-41139

To remediate CVE-2026-41139, upgrade the affected package to a fixed version below.

• —upgrade to 15.2.0 or later

Is CVE-2026-41139 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 13.1.0, < 15.2.0

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-41139
• PATCHgithub.com/josdejong/mathjs
• WEBgithub.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
• WEBgithub.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611