CVE-2026-40897CWE-915

Math.js: Unsafe object property setter in mathjs

High · published April 24, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00761 · 54.9th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-04-24T16:48Z
EPSS history
Timeline
  • 24 APR 16:48Z
    Math.js: Unsafe object property setter in mathjs
    cvelistv5