{"action":"Upgrade mathjs to 15.2.0 or later.","affected":[{"fixed":"15.2.0","introduced":"13.1.0"}],"component":"mathjs","cve_ids":["CVE-2026-41139"],"ecosystem":"npm","epss":0.00577,"exploited":false,"fixed_versions":["15.2.0"],"ghsa_id":"GHSA-jvff-x2qm-6286","id":"tcs_01M5KFZ10JM4BM4A77Y61AG10S","modified_at":"2026-09-10T03:50:44.603942782Z","published_at":"2026-04-10T22:10:49Z","references":["https://osv.dev/vulnerability/GHSA-jvff-x2qm-6286","https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g","https://github.com/josdejong/mathjs/security/advisories/GHSA-jvff-x2qm-6286","https://nvd.nist.gov/vuln/detail/CVE-2026-41139","https://github.com/josdejong/mathjs/pull/3656","https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4","https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611","https://github.com/josdejong/mathjs","https://github.com/josdejong/mathjs/releases/tag/v15.2.0"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-jvff-x2qm-6286","url":"https://osv.dev/vulnerability/GHSA-jvff-x2qm-6286"}],"summary":"mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes"}