CVE-2026-41139: Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary...
HIGH
CVSS 8.8
Exploit Available
Published: May 7, 2026 | Last Modified: May 7, 2026
Description
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
Ghostwire Analysis — What This Means Practically
- High CVSS score indicates significant risk — exploitation could lead to substantial data exposure or system compromise.
- Exploit code is reported to be available, increasing the likelihood of active exploitation.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.
Security Coverage (1 articles)
References