Review reviewHigh

CVE-2026-40897

josdejong mathjs, Red Hat Developer Hub, Red Hat Enterprise Linux 10

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

CVSS: 8.8
EPSS: 0.55%
CISA KEV: Not listed
Published: 2026.04.25

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.55%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: josdejong mathjs, Red Hat Developer Hub, Red Hat Enterprise Linux 10
Affected versions: >= >= 13.1.1, < 15.2.0, >= 13.1.1 < 15.2.0
Fixed versions: 15.2.0

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that josdejong mathjs, Red Hat Developer Hub, Red Hat Enterprise Linux 10 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-915, CWE-917