Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Remediation

References

CVE-2026-41139

Related Vulnerabilities

WordPress Plugin Booking Calendar Cross-Site Request Forgery (9.2.1)

OpenSSL Numeric Errors Vulnerability (CVE-2009-0789)

Wordpress Plugin Backup Migration Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36884)

Moodle Improper Check for Dropped Privileges Vulnerability (CVE-2019-14879)

MySQL CVE-2020-2762 Vulnerability (CVE-2020-2762)

Severity

High

Classification

CVE-2026-41139 CWE-915 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities