CVE-2026-41139 HIGH

CVE-2026-41139: Unsafe array index getter in mathjs

Vendor Josdejong
Product mathjs
Weakness CWE-915
Published May 7, 2026
Last update June 30, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Key dates

02Disclosure timeline

May 7, 2026 CVE published
June 30, 2026 Record updated