A vulnerability in mathjs versions 13.1.0 through before 15.2.0 allows arbitrary JavaScript execution via its expression parser. This affects applications that evaluate user-supplied expressions using mathjs. The issue is fixed in version 15.2.0. No workaround exists other than upgrading.