Read the docs
TI-2026-29767 Aliases CVE-2026-41139GHSA-jvff-x2qm-6286

Unsafe array index getter in mathjs

Priority MEDIUM 41CWE-915Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-915.

Summary

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00577 47th percentileScored 2026-11-07
Fix Fixed mathjs (josdejong): 15.2.0mathjs (npm): 15.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
josdejongmathjs13.1.0 to before 15.2.015.2.0Patch availableCNA
—mathjs (npm)13.1.0 to before 15.2.015.2.0Patch availableGHSA-jvff-x2qm-6286
  • mathjs Vendorjosdejong Affected 13.1.0 to before 15.2.0 Fixed in 15.2.0 Patch available CNA
  • mathjs (npm) Vendor— Affected 13.1.0 to before 15.2.0 Fixed in 15.2.0 Patch available GHSA-jvff-x2qm-6286

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:*13.1.0 to before 15.2.0Vulnerablemath.js
  • cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:* Versions 13.1.0 to before 15.2.0 Vulnerable ·math.js

Remediation

  • Fix · CNA mathjs (josdejong) Fixed in 15.2.0
  • Fix · GHSA-jvff-x2qm-6286 mathjs (npm) Fixed in 15.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 8 products
  • Cryostat 4
  • Red Hat Developer Hub 1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41139
  2. 2026-10-03 Alias added: GHSA-jvff-x2qm-6286
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-27 Affected versions changed · Red Hat

References

Patch 4

Advisory 1

Other 3

  • TI-2026-29553 Math.js: Unsafe object property setter in mathjs CVSS 3.1HIGH 8.8
  • TI-2020-06261 Prototype pollution in mathjs CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences