Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Remediation

References

CVE-2026-41139

Related Vulnerabilities

WordPress Plugin Ninja Popups Multiple Vulnerabilities (4.5.3)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-31805)

WordPress Plugin Appointment Hour Booking-WordPress Booking Cross-Site Scripting (1.1.44)

WordPress Plugin Clone Cross-Site Scripting (2.1.1)

SharePoint CVE-2021-34467 Vulnerability (CVE-2021-34467)

Severity

High

Classification

CVE-2026-41139 CWE-915 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities