CVE-2026-41139

8.8 Élevée

Publiée le 07/05/2026 à 08:16 · Modifiée le 15/07/2026 à 04:21 · Modifiée · Source : security-advisories@github.com

Description

Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

Traduire en français

Produits concernés

josdejong mathjs
Red Hat Cryostat 4
Red Hat Developer Hub
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat Self-service automation portal 2
Mathjs mathjs

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.0	8.8 Élevée	security-advisories@github.com	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-915
CWE-94

Références

https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4 Patch
https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611 Patch
https://github.com/josdejong/mathjs/pull/3656 Issue TrackingPatch
https://github.com/josdejong/mathjs/releases/tag/v15.2.0 Release Notes
https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g PatchVendor Advisory
https://access.redhat.com/security/cve/CVE-2026-41139
https://bugzilla.redhat.com/show_bug.cgi?id=2467648
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41139.json

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories