CVE-2026-40897 Math.js: Unsafe object property setter in mathjs
Attackers can execute arbitrary JavaScript via the mathjs expression parser if applications allow users to evaluate arbitrary expressions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40897?
CVE-2026-40897 is a high-severity code injection vulnerability in josdejong mathjs, published on 24 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.
Which versions are affected by CVE-2026-40897?
2 open source packages ship an affected version, including mathjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mathjs npm | From 13.1.1 | 15.2.0 |
mathjs npm | From 13.1.1 | 15.2.0 |
Products include Mathjs Mathjs.
How do I fix CVE-2026-40897?
Upgrade mathjs to 15.2.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40897 being exploited?
There is no known exploitation of CVE-2026-40897 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in josdejong mathjs
Sources
Also known as GHSA-29qv-4j9f-fjw5.