The mathjs library for JavaScript and Node.js contains a vulnerability in versions >=13.1.1 and <15.2.0 that permits execution of arbitrary JavaScript code through its expression parser. This occurs because the library does not properly control modifications of dynamically-determined object attributes, classified under CWE-915. Applications that allow users to evaluate arbitrary expressions using mathjs are at risk. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The vulnerability was publicly disclosed on April 24, 2026, and is fixed in mathjs version 15.2.0.

Successful exploitation allows an attacker with at least low privileges to execute arbitrary JavaScript code remotely without user interaction, resulting in complete confidentiality, integrity, and availability compromise of the affected system or application. This can lead to full system takeover or data breach in applications that evaluate untrusted expressions using mathjs versions prior to 15.2.0.

Upgrade mathjs to version 15.2.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 15.2.0, applying this official patch is the recommended remediation. No other mitigations are indicated by the vendor advisory.