CVE-2026-41139: Math.js Expression Parser RCE Vulnerability

CVE-2026-41139 Overview

CVE-2026-41139 is an arbitrary JavaScript execution vulnerability in Math.js, a widely used math library for JavaScript and Node.js. The flaw exists in the expression parser and affects versions from 13.1.0 up to (but not including) 15.2.0. Attackers who can submit crafted mathematical expressions to an application using mathjs can break out of the parser sandbox and execute arbitrary JavaScript in the host process. The issue is tracked under [CWE-915] and was patched in version 15.2.0.

Critical Impact

Successful exploitation grants attackers arbitrary JavaScript execution within the application context, leading to full compromise of confidentiality, integrity, and availability of the host process.

Affected Products

• Math.js versions 13.1.0 through 15.1.x
• Node.js applications embedding the mathjs expression parser
• Browser applications exposing mathjs evaluation to untrusted input

Discovery Timeline

• 2026-05-07 - CVE-2026-41139 published to NVD
• 2026-05-07 - Last updated in NVD database
• Patch released in Math.js v15.2.0
• Tracked in GitHub Security Advisory GHSA-5v89-rwgr-qj6g

Technical Details for CVE-2026-41139

Vulnerability Analysis

Math.js exposes an expression parser that evaluates user-supplied formulas. The parser enforces a property allow-list to prevent access to dangerous JavaScript internals such as constructor, __proto__, and prototype methods. The vulnerability arises because the property safety checks were inconsistently applied across helper utilities, including src/utils/array.js and src/utils/map.js. Attackers can craft expressions that pass arguments of unexpected types, such as objects or non-array structures, into functions that previously assumed safe inputs. This allows attacker-controlled property access to reach unsafe JavaScript objects and execute arbitrary code.

Root Cause

The root cause is improperly controlled modification of dynamically determined object attributes [CWE-915]. Helper functions did not validate that index arguments were arrays before iterating them, and property accessors used getSafeProperty checks that did not cover all object property classes. The fix introduces stricter input type validation and a new isSafeObjectProperty helper that broadens the unsafe-property denylist used by map and object utilities.

Attack Vector

Exploitation requires the attacker to submit an evaluated expression to math.evaluate() or the equivalent parser entry point. Any application that accepts user-supplied formulas — for example, a calculator service, dashboard formula field, or scientific notebook — is exposed if it forwards untrusted strings to the parser. No special privileges beyond the ability to submit an expression are required, and no user interaction is needed once the input reaches the parser.

// Patch excerpt from src/utils/array.js — adds type validation on the
// index parameter to prevent attacker-supplied non-array objects from
// reaching unsafe property lookups.
export function get (array, index) {
  if (!Array.isArray(array)) { throw new Error('Array expected') }
  if (!Array.isArray(index)) {
    throw new Error('Array expected for index')
  }
  const size = arraySize(array)
  if (index.length !== size.length) {
    throw new DimensionError(index.length, size.length)
  }
  for (let x = 0; x < index.length; x++) {
    validateIndex(index[x], size[x])
  }
}
// Source: https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4

// Patch excerpt from src/utils/map.js — replaces isSafeProperty with the
// stricter isSafeObjectProperty helper to block access to additional
// dangerous object properties during expression evaluation.
import {
  getSafeProperty,
  isSafeObjectProperty,
  setSafeProperty
} from './customs.js'
import { isMap, isObject } from './is.js'
// Source: https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4

Detection Methods for CVE-2026-41139

Indicators of Compromise

• Math.js expression strings referencing constructor, __proto__, prototype, or Function submitted to evaluation endpoints
• Outbound network connections, child process spawns, or filesystem writes originating from Node.js workers that should only perform math evaluation
• Unexpected eval, child_process, or require calls in process telemetry from services embedding mathjs

Detection Strategies

• Inspect dependency manifests (package.json, package-lock.json, yarn.lock) for mathjs versions between 13.1.0 and 15.1.x
• Log all expressions submitted to math.evaluate() and alert on suspicious tokens such as property accessors targeting JavaScript internals
• Monitor Node.js runtime behavior for spawned shells or new module loads following expression parser invocation

Monitoring Recommendations

• Forward Node.js application and process telemetry to a centralized analytics platform for behavioral correlation
• Baseline expected mathjs workload behavior and alert on deviations such as new outbound destinations or file writes
• Track Software Composition Analysis (SCA) findings to confirm patched versions are deployed across all environments

How to Mitigate CVE-2026-41139

Immediate Actions Required

• Upgrade mathjs to version 15.2.0 or later in all production, staging, and developer environments
• Audit applications that pass untrusted input to math.evaluate() and add server-side input filtering
• Rebuild and redeploy container images and serverless bundles that embed vulnerable mathjs releases

Patch Information

The vulnerability is fixed in Math.js v15.2.0. The relevant fixes are introduced in commit 0aee2f6 and commit bcf0da4, with additional context in Pull Request #3656 and the GitHub Security Advisory GHSA-5v89-rwgr-qj6g.

Workarounds

• Restrict the parser surface using math.import with { override: true } to remove unused functions reachable from expressions
• Run expression evaluation in an isolated worker thread or sandboxed Node.js process with no filesystem or network access
• Apply strict allow-lists on user-supplied formula syntax before forwarding strings to the parser

# Upgrade mathjs to the patched release
npm install mathjs@^15.2.0

# Verify the installed version
npm ls mathjs

# Audit the project for residual vulnerable transitive dependencies
npm audit --production