Math.js parser RCE in expression eval (CVE-2026-40897) [PoC]

Vendor-confirmed - CVE-2026-40897 is a high-severity RCE in Math.js versions 13.1.1 through 15.1.0 that lets unauthenticated attackers execute arbitrary JavaScript on the server via the expression parser. Patched in 15.2.0 - update immediately.

Overview

CVE-2026-40897 affects the Math.js expression parser, a feature designed to evaluate mathematical expressions dynamically. An attacker who can submit arbitrary expressions to the parser can inject malicious JavaScript code, gaining the ability to execute system commands, read sensitive data, or manipulate server-side logic. The vulnerability exists because the parser does not properly sanitize user-supplied input during evaluation, allowing unexpected code paths to reach JavaScript execution functions.

This vulnerability receives a CVSS score of 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N - meaning it can be exploited over the network with low complexity, requires only low privileges, and needs no user interaction. Any application that exposes the Math.js expression parser to user input is at risk.

Impact

An attacker exploiting CVE-2026-40897 achieves remote code execution (RCE) on the server hosting the vulnerable application. This can lead to complete server compromise, including data exfiltration, lateral movement within the network, and persistent access via backdoors. Unlike typical injection attacks that target operating system commands, this vulnerability uses JavaScript, the same language as the runtime, making detection more difficult for signature-based defenses.

Remediation

Update Math.js to version 15.2.0 or later immediately. The fix disables unsafe evaluation paths in the expression parser. If immediate patching is not possible, restrict access to the expression parser to trusted users only, and implement input validation to block suspicious expression patterns. Consider using a Web Application Firewall (WAF) to filter malicious expression payloads while you migrate.

Security Insight

This vulnerability belongs to the growing class of parser injections that target library-internal languages rather than operating system shells. Similar flaws exist in other evaluation engines such as Python’s eval(), Python’s exec(), and JavaScript’s Function() constructor. The Math.js team has addressed this by tightening the parser’s sandbox, but developers should treat any user-controllable expression parser as a high-risk attack surface and sandbox it separately from application logic. Data breach reports are available at breach reports. For more cybersecurity news, visit security news.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs