CVE-2026-41139

Katalog CVE

CVSS 8.8 · High EPSS 0,80%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada mathjs. Skor CVSS 3.1 8.8 (High) menurut CNA.

Deskripsi (NVD)

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g patch · advisory vendor
• https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 patch
• https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 patch
• https://github.com/josdejong/mathjs/pull/3656 issue tracking · patch
• https://github.com/josdejong/mathjs/releases/tag/v15.2.0 release notes
• https://access.redhat.com/security/cve/CVE-2026-41139
• https://bugzilla.redhat.com/show_bug.cgi?id=2467648
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json