An unsafe array index getter in math.js exposes the expression parser to arbitrary JavaScript execution. The vulnerability allows a malicious user to inject crafted expressions that are evaluated by the library, leading to execution of arbitrary code within the context of the application — a classic remote code execution flaw. This weakness is classified as CWE‑915 and CWE‑94 and carries a CVSS score of 8.8, indicating a high severity.

The flaw affects the math.js library in versions 13.1.0 through the final release preceding 15.2.0, maintained by josdejong. Applications depending on any of those releases are susceptible; upgrading to version 15.2.0 or later eliminates the issue.

Without the official patch, the EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger it by injecting malicious content into any input that is processed by math.js’s expression parser. Consuming user‑supplied expressions without validation or with insufficient sandboxing permits the attacker to run arbitrary JavaScript code on the host where the library executes.