CVE-2026-40897: Math.js Expression Parser RCE Vulnerability

CVE-2026-40897 Overview

A critical arbitrary code execution vulnerability has been identified in Math.js, an extensive math library for JavaScript and Node.js. The vulnerability exists in the expression parser component, allowing attackers to execute arbitrary JavaScript code when user-supplied expressions are evaluated. Applications that permit users to evaluate arbitrary expressions using the mathjs expression parser are at risk of complete system compromise.

Critical Impact

Attackers can achieve arbitrary JavaScript code execution through the mathjs expression parser, potentially leading to full application compromise, data theft, and server-side code execution in Node.js environments.

Affected Products

• Math.js versions 13.1.1 through 15.1.x (prior to 15.2.0)
• Node.js applications using vulnerable mathjs expression parser
• JavaScript applications integrating mathjs for user-provided expression evaluation

Discovery Timeline

• 2026-04-24 - CVE CVE-2026-40897 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-40897

Vulnerability Analysis

This vulnerability (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) allows attackers to bypass security controls in the mathjs expression parser. The flaw exists in the internal setSafeProperty function, which failed to properly restrict property assignments on objects. By crafting malicious expressions, an attacker could manipulate object properties beyond intended boundaries, ultimately achieving arbitrary JavaScript code execution.

The vulnerability is particularly dangerous in applications where untrusted users can submit mathematical expressions for evaluation. Since mathjs is commonly used in educational platforms, scientific calculators, and data processing applications, the attack surface is significant across the JavaScript and Node.js ecosystems.

Root Cause

The root cause lies in the insufficient validation within the setSafeProperty utility function located in src/utils/map.js. The function was designed to prevent unsafe property modifications but contained a flaw that allowed attackers to set properties beyond the intended safe boundaries. The security patch addresses this by replacing isSafeProperty with the more restrictive isSafeObjectProperty check, ensuring only explicitly permitted object properties can be modified during expression evaluation.

Attack Vector

The attack is network-accessible and requires low privileges to execute. An attacker with the ability to submit expressions to a vulnerable mathjs parser can craft specially formatted input that escapes the expression sandbox. This allows direct JavaScript execution within the context of the application, bypassing mathjs's built-in security controls.

In web applications, this could be exploited through form inputs, API endpoints, or WebSocket messages that accept mathematical expressions. In Node.js server environments, successful exploitation could lead to server-side code execution, file system access, and complete system compromise.

-import { getSafeProperty, isSafeProperty, setSafeProperty } from './customs.js'
+import {
+  getSafeProperty,
+  isSafeObjectProperty,
+  setSafeProperty
+} from './customs.js'
 import { isMap, isObject } from './is.js'
 
 /**

Source: GitHub Commit Update

Detection Methods for CVE-2026-40897

Indicators of Compromise

• Unusual or malformed mathematical expressions in application logs containing JavaScript syntax or object manipulation patterns
• Unexpected server-side process spawning or file system access following expression evaluation requests
• Application errors or exceptions originating from the mathjs expression parser with stack traces indicating property manipulation

Detection Strategies

• Implement input validation logging to capture and analyze all expressions submitted to the mathjs parser
• Monitor application behavior for anomalous JavaScript execution patterns following expression evaluation
• Deploy runtime application self-protection (RASP) to detect and block code injection attempts within expression parsing contexts
• Review dependency manifests to identify mathjs versions between 13.1.1 and 15.1.x

Monitoring Recommendations

• Enable detailed logging for all mathjs evaluate() function calls with input sanitization alerts
• Configure intrusion detection systems to flag HTTP requests containing potential JavaScript injection patterns in mathematical expression fields
• Implement anomaly detection for unusual Node.js process behavior indicative of sandbox escape

How to Mitigate CVE-2026-40897

Immediate Actions Required

• Upgrade mathjs to version 15.2.0 or later immediately
• Audit all application entry points where user-supplied expressions are passed to the mathjs parser
• Implement additional input validation as a defense-in-depth measure while scheduling upgrades
• Review application logs for any historical exploitation attempts

Patch Information

The vulnerability is fixed in mathjs version 15.2.0. The patch, available via GitHub Commit 513ab2a0e01004af91b31aada68fae8a821326ad, improves the internal setSafeProperty function to properly restrict property modifications. The fix replaces the isSafeProperty validation with the more secure isSafeObjectProperty check, preventing attackers from manipulating object attributes outside of intended boundaries. Full details are available in the GitHub Security Advisory GHSA-29qv-4j9f-fjw5.

Workarounds

• Restrict or disable user-supplied expression evaluation until the patch can be applied
• Implement strict allowlisting of mathematical functions and operators that users can access
• Run mathjs expression evaluation in an isolated sandbox environment with restricted permissions
• Consider using mathjs in "limited" mode to reduce the attack surface of the expression parser

# Update mathjs to the patched version
npm update mathjs@15.2.0

# Verify installed version
npm list mathjs