CVE-2026-40897: mathjs Arbitrary JavaScript Execution via Expression Parser
Summary
CVE-2026-40897: Unsafe object property setter in mathjs. Affects mathjs versions >= 13.1.1, < 15.2.0. Fixed in 15.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mathjs is a comprehensive mathematics library for JavaScript and Node.js, designed to handle a wide range of mathematical operations, including algebra, calculus, and statistics. It allows users to evaluate expressions, perform calculations, and manipulate mathematical objects. However, a recent vulnerability has been identified that exposes applications using mathjs to potential security risks when users can evaluate arbitrary expressions.
Vulnerability Detail
The vulnerability arises from an unsafe object property setter in the mathjs expression parser, which allows for the execution of arbitrary JavaScript code. This issue was introduced in version 13.1.1 and can be exploited in applications where users are permitted to input and evaluate expressions. The ramifications include unauthorized access to sensitive data, manipulation of application behavior, and potential system compromise.
How To Fix
Latest published version: 15.2.0 as of 22 Oct 2026
npm install mathjs@15.2.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no effective workarounds available without upgrading to version 15.2.0. It is strongly recommended to apply the update to mitigate the risk associated with this vulnerability.
Conclusion
In summary, CVE-2026-40897 is a critical vulnerability in the mathjs library that allows for arbitrary JavaScript execution through its expression parser. It is crucial for developers to update to version 15.2.0 or later to mitigate the risks associated with this vulnerability. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for mathjs →
FAQ
CVE-2026-40897 is a security vulnerability in the mathjs library that allows for arbitrary JavaScript execution through its expression parser.
If your application uses mathjs version 13.1.1 to 15.1.9 and allows users to evaluate arbitrary expressions, it is likely affected by this vulnerability.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, manipulation of application behavior, and potential system compromise.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your package-lock.json file. You can also check if your application is affected using the Vulert playground without any signup.
The CVSS score of this vulnerability is 8.8, indicating a high level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mathjs.
