Unsafe object property setter in mathjs

Description

This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Recommendation

Update the mathjs package to the latest compatible version. Followings are version details:

• Affected version(s): >= 13.1.1, < 15.2.0
• Patched version(s): 15.2.0

References

• GHSA-29qv-4j9f-fjw5
• CVE-2026-40897
• CWE-915
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes - CVE-2026-41139
• Maker.js has Unsafe Property Copying in makerjs.extendObject - CVE-2026-24888
• Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing - CVE-2026-1664
• ApostropheCMS: Stored XSS via CSS Custom Property Injection in @apostrophecms/color-field Escaping Style Tag Context - CVE-2026-33889

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

mathjs