PT-2026-38340 · Npm · Math.Js

CVE-2026-41139

Published

2026-04-10

Updated

2026-05-10

CVSS v3.1

8.8

High

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Math.js versions 13.1.0 through 15.1.x

Description Arbitrary JavaScript can be executed through the expression parser of the library.

Recommendations Update to version 15.2.0.

Exploit

Fix

DoS

RCE

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

CVE-2026-41139

GHSA-5V89-RWGR-QJ6G

GHSA-JVFF-X2QM-6286

Math.Js