CVE-2026-40897

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad	Patch
https://github.com/josdejong/mathjs/pull/3656	Issue Tracking
https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-40897
https://bugzilla.redhat.com/show_bug.cgi?id=2461612
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40897.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Math.js es una extensa biblioteca matemática para JavaScript y Node.js. Desde la 13.1.1 hasta antes de la 15.2.0, una vulnerabilidad permitía ejecutar JavaScript arbitrario a través del analizador de expresiones de mathjs. Puede verse afectado si tiene una aplicación donde los usuarios pueden evaluar expresiones arbitrarias utilizando el analizador de expresiones de mathjs. Esta vulnerabilidad está corregida en la 15.2.0.

Information

Published : 2026-04-24 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40897

Mitre link : CVE-2026-40897

CVE.ORG link : CVE-2026-40897

JSON object : View

Products Affected

mathjs

mathjs

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

{"id": "CVE-2026-40897", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40897", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T17:44:50.632032Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "josdejong", "product": "mathjs", "versions": [{"status": "affected", "version": ">= 13.1.1, < 15.2.0"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:rhdh:1"], "vendor": "Red Hat", "product": "Red Hat Developer Hub", "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "qt6-qtbase", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "qt5-qtbase", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "qt5-qtbase", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-dashboard-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-maas-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-mod-arch-model-registry-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift4/ose-monitoring-plugin-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:ansible_portal:2"], "vendor": "Red Hat", "product": "Self-service automation portal 2", "packageName": "ansible-automation-platform/automation-portal", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-04-24T17:16:20.783", "references": [{"url": "https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/josdejong/mathjs/pull/3656", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-40897", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461612", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40897.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-915"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-917"}]}], "descriptions": [{"lang": "en", "value": "Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0."}, {"lang": "es", "value": "Math.js es una extensa biblioteca matem\u00e1tica para JavaScript y Node.js. Desde la 13.1.1 hasta antes de la 15.2.0, una vulnerabilidad permit\u00eda ejecutar JavaScript arbitrario a trav\u00e9s del analizador de expresiones de mathjs. Puede verse afectado si tiene una aplicaci\u00f3n donde los usuarios pueden evaluar expresiones arbitrarias utilizando el analizador de expresiones de mathjs. Esta vulnerabilidad est\u00e1 corregida en la 15.2.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mathjs:mathjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8DB079CB-9A5C-4138-B8E5-7607D3DDC20A", "versionEndExcluding": "15.2.0", "versionStartIncluding": "13.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}