CVE-2026-41139
CVE-2026-41139 · Unsafe array index getter in mathjs
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.
CVSS 8.8 · Élevée · EPSS 0,6% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node
Produits et versions concernés
Sources originales
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
- https://github.com/josdejong/mathjs/pull/3656
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
- https://github.com/josdejong/mathjs/releases/tag/v15.2.0
- https://access.redhat.com/security/cve/CVE-2026-41139
- https://bugzilla.redhat.com/show_bug.cgi?id=2467648
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-41139