CVE-2026-41139
Description
mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security-advisories@github.com — https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
Vendor advisory: security-advisories@github.com — https://github.com/josdejong/mathjs/releases/tag/v15.2.0
Vendor advisory: security-advisories@github.com — https://github.com/josdejong/mathjs/pull/3656
Vendor advisory: security-advisories@github.com — https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
Vendor advisory: security-advisories@github.com — https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| mathjs | mathjs | {"startIncluding":"13.1.0","endExcluding":"15.2.0"} | 15.2.0 |
References
- https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
- https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
- https://github.com/josdejong/mathjs/pull/3656
- https://github.com/josdejong/mathjs/releases/tag/v15.2.0
- https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
- https://github.com/josdejong/mathjs/security/advisories/GHSA-jvff-x2qm-6286
- https://nvd.nist.gov/vuln/detail/CVE-2026-41139
- https://github.com/josdejong/mathjs
- https://github.com/advisories/GHSA-jvff-x2qm-6286
CWEs
CWE-915
Verify integrity in audit chain (admin only). AS-IS.