CVE-2026-41139

Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-915
Reserved: 2026-04-17
Published: 2026-05-07 07:06 UTC
Last updated: 2026-05-07 15:41 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/41xxx/CVE-2026-41139.json
Linked Threat: CVE-2026-41139 — Unsafe array index getter in mathjs

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-07 06:16:04 UTC
NVD last modified: 2026-05-08 17:06:03 UTC
EPSS score: 0.0003 (probability of exploitation in next 30 days)
EPSS percentile: 9.11% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-28310
Assigner: GitHub_M
Published: May 7, 2026, 5:06:28 AM
Updated: May 7, 2026, 1:41:40 PM
EUVD base score (CVSS 3.0): 8.8 / 10
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0300
Vendors: josdejong
Products: mathjs (13.1.0, < 15.2.0)
Aliases: GHSA-jvff-x2qm-6286

ENISA description: Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

EUVD references (5)

Affected products (1)

Vendor	Product	Versions	Platforms
josdejong	mathjs	`>= 13.1.0, < 15.2.0` (affected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:*

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g x_refsource_CONFIRM
https://github.com/josdejong/mathjs/pull/3656 x_refsource_MISC
https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 x_refsource_MISC
https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 x_refsource_MISC
https://github.com/josdejong/mathjs/releases/tag/v15.2.0 x_refsource_MISC

MITRE references (5) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://github.com/josdejong/mathjs/releases/tag/v15.2.0 x_refsource_MISC
https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 x_refsource_MISC
https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g x_refsource_CONFIRM
https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 x_refsource_MISC
https://github.com/josdejong/mathjs/pull/3656 x_refsource_MISC

Web references (3)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

https://nvd.nist.gov/vuln/detail/CVE-2026-41139 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-41139 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 security-advisories@github.com Patch
https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 security-advisories@github.com Patch
https://github.com/josdejong/mathjs/pull/3656 security-advisories@github.com Issue TrackingPatch
https://github.com/josdejong/mathjs/releases/tag/v15.2.0 security-advisories@github.com Release Notes
https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g security-advisories@github.com PatchVendor Advisory

Indicators (2)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
domain	`node.js`	no local data	2026-05-18 21:18 UTC
domain	`math.js`	no local data	2026-05-18 21:18 UTC

Remediations (20)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

VirusTotal - Home

web:www.virustotal.com

VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.

2026-05-22 17:10 UTC
Google Chrome Update Fixes 26 Security Flaws, Including RCE Vulnerabilities

web:cyberpress.org

Google has released a new Chrome stable update that patches 26 security vulnerabilities, including three critical bugs that could allow remote code execution (RCE) when a victim simply visits a malicious web page or processes crafted web content. The update is rolling out to Windows and macOS as version 146..7680.153/154 and to Linux as 146..7680.153. Patch overview The March 18, 2026 ...

2026-05-22 17:10 UTC
Critical Chrome Vulnerabilities Enables Remote Code Execution Attacks ...

web:cybersecuritynews.com

Google released a critical Chrome update fixing multiple high-risk vulnerabilities that could enable arbitrary code execution.

2026-05-22 17:10 UTC
Patch Tuesday, April 2026 Edition - Krebs on Security

web:krebsonsecurity.com

For a clickable, per- patch breakdown, check out the SANS Internet Storm Center Patch Tuesday roundup. Running into problems applying any of these updates?

2026-05-22 17:10 UTC
Nvd - Cve-2026-3913

web:nvd.nist.gov

An official website of the United States government Here's how you know

2026-05-22 17:10 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-05-22 17:10 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-05-22 17:10 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-22 17:10 UTC
Vulnerability Remediation vs. Mitigation: What are the Differences ...

web:www.secure.com

Learn the difference between vulnerability remediation and mitigation , and how a risk-based strategy can strengthen your security posture.

2026-05-22 17:10 UTC
Zero-Day Threat Report May 2026 - CVEs, Exploits & Remediation ...

web:carthageelectronics.com

Status: Actively exploited — CISA KEV listed — patch by May 12, 2026 What Happened On April 28, 2026 , CISA added CVE - 2026 -32202 to its Known Exploited Vulnerabilities (KEV) catalog with a federal remediation deadline of May 12, 2026 . This vulnerability is the result of an incomplete patch Microsoft released in February for CVE - 2026 -21510.

2026-05-22 17:10 UTC
CVE-2026-41139 - Math.js - Command Injection | LeakyCreds

web:www.leakycreds.com

Technical analysis of CVE-2026-41139 including high severity, CVSS 8.8, impact assessment, and exploitation activity. Updated vulnerability intelligence by LeakyCreds.

2026-05-22 04:16 UTC
Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

2026-05-22 04:16 UTC
CVE-2026-41139 - High Vulnerability - TheHackerWire

web:www.thehackerwire.com

What is CVE-2026-41139 ? How severe is CVE-2026-41139 ? What Mathjs products are affected by CVE-2026-41139 ? How do I fix or mitigate CVE-2026-41139 ? When was CVE-2026-41139 disclosed?

2026-05-22 04:16 UTC
Broken and Updated Sims 4 Mods and CC: patch 1.124, May 12, 2026

web:forums.ea.com

Broken and Updated Sims 4 Mods and CC: patch 1.124, May 12, 2026 About This Thread This thread tracks Sims 4 mods and CC that have been "broken" or made obsolete by game update 1.124, May 12, 2026 , or declared unsupported by their creators.

2026-05-22 04:16 UTC
Upcoming highly critical release on May 20, 2026 - PSA-2026-05-18 - Drupal

web:www.drupal.org

Mitigation information will be included in the advisory. We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before May 20, so that you can address any other upgrade issues before the security window. (Recommendations for specific Drupal versions follow.)

2026-05-22 04:16 UTC
Fix Ferreterías

web:www.fixferreterias.com

FIX FERRETERÍAS Acerca de nosotros Ubica tu tienda Catálogo Grupo Truper SOPORTE AL CLIENTE Facturación Cotizaciones Preguntas Frecuentes Mis pedidos POLÍTICAS Ventas Devoluciones Garantías Precios Aviso de privacidad

2026-05-22 04:16 UTC
The Official Fix Chocolate Bar | Dubai's Viral Chocolate Bars

web:officialfixdessertchocolatier.com

Indulge in Dubai's viral chocolate bars with FIX Dessert Chocolatier. Shop our hero collection featuring Baklawa, Knafeh, Biscoff, and more. Fast delivery in Dubai & Abu Dhabi. Order now!

2026-05-22 04:16 UTC
Joliet News, Breaking News in Joliet, IL - Patch

web:patch.com

Joliet Latest Headlines: 5-Car Wreck On Ridge Road Sent 3 Motorists To Hospital With Serious Injuries: Sheriff's Office ; Photo Gallery: Joliet's First-Ever Memorial Day Commemoration Held New ...

2026-05-22 04:16 UTC
patch.moe - Age Verification

web:patch.moe

Age Verification Are you 18 years or older? YES NO

2026-05-22 04:16 UTC
Patch - patch

web:patchnashville.com

Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories. My hope is that you always find what you came for and feel as inspired by our collections as we are.

2026-05-22 04:16 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-41139.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-07T13:41:05.634680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-07T13:41:40.987Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mathjs",
          "vendor": "josdejong",
          "versions": [
            {
              "status": "affected",
              "version": ">= 13.1.0, < 15.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T05:06:28.746Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g"
        },
        {
          "name": "https://github.com/josdejong/mathjs/pull/3656",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/josdejong/mathjs/pull/3656"
        },
        {
          "name": "https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4"
        },
        {
          "name": "https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611"
        },
        {
          "name": "https://github.com/josdejong/mathjs/releases/tag/v15.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/josdejong/mathjs/releases/tag/v15.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5v89-rwgr-qj6g",
        "discovery": "UNKNOWN"
      },
      "title": "Unsafe array index getter in mathjs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41139",
    "datePublished": "2026-05-07T05:06:28.746Z",
    "dateReserved": "2026-04-17T12:59:15.738Z",
    "dateUpdated": "2026-05-07T13:41:40.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}