A Popular Math Library Could Let Hackers Take Over Your Server by Typing an Equation

If your application lets users type in a math formula, an attacker may already have everything they need to take over your server completely.

Who's at Risk — and How Big Is This?

The vulnerability lives inside math-codegen, an open-source JavaScript library downloaded hundreds of thousands of times from the npm registry. It's the kind of building block that ends up quietly embedded in scientific calculators, online graphing tools, educational platforms, financial modeling apps, and any web service that needs to evaluate user-provided mathematical expressions on the fly. If your team has ever needed to turn something like sin(x) * 2 + y into runnable code, there's a reasonable chance math-codegen is somewhere in your stack.

Every one of those applications — running on any operating system, in any cloud environment — is potentially affected by CVE-2026-41507, rated 9.8 out of 10 (CRITICAL) on the standard severity scale. That near-perfect danger score means exploitation requires no special access, no password, and no insider knowledge. An anonymous stranger on the internet with a browser and some curiosity could be enough.

What an Attacker Can Actually Do

Here's how this plays out in the real world. Imagine a tutoring website that lets students type math problems into a box and see the answer computed instantly on the server. Behind the scenes, the site passes whatever the student typed directly into the math-codegen library to be parsed and evaluated. That's the intended use case — that's what the library is for.

The problem is that math-codegen, in versions before 0.4.3, trusted that input completely. It took the user's text, dropped it straight into a JavaScript function body with no checking, and ran it. An attacker doesn't need to type a math problem. They can type something that looks like a math problem but is actually an instruction to the server itself — telling it to read sensitive files, create new admin accounts, download malware, or beam your entire customer database to an address the attacker controls. The server obeys, because as far as it's concerned, the instruction came from its own code.

The practical outcome is what security researchers call Remote Code Execution — the attacker's commands run with whatever permissions your server process has. In many production deployments, that means unrestricted access to the underlying system. Game over.

The Technical Root Cause

For the researchers in the room: this is a classic Function constructor injection vulnerability. The library passes unsanitized user input verbatim into a new Function() body — JavaScript's runtime equivalent of eval() — with no allowlist, no sandboxing, and no escaping. Because new Function() executes in the global scope rather than a sandboxed context, payloads can trivially reach Node.js's child_process module and spawn arbitrary shell commands. The attack surface is any endpoint where user-controlled strings flow into cg.parse().

Has This Been Exploited?

As of publication, no confirmed active exploitation has been reported in the wild, and there are no known victim organizations or documented attack campaigns targeting this specific CVE. That's the good news. The sobering context is that npm packages with high download counts and easy-to-exploit critical vulnerabilities have a historically short window between public disclosure and the first opportunistic scans. Threat actors routinely monitor vulnerability feeds and target exactly this class of flaw — unauthenticated, low-complexity, maximum impact — as soon as a patch ships and the attack surface becomes obvious.

The vulnerability was discovered and responsibly disclosed by security researchers, and the math-codegen maintainers have issued a patch. But the clock is ticking for anyone who hasn't updated.

What To Do Right Now

These three steps should happen before your next coffee gets cold:

Update math-codegen to version 0.4.3 immediately. Run npm install math-codegen@0.4.3 or npm update math-codegen in your project directory. Verify the installed version with npm list math-codegen and confirm you see 0.4.3 or higher. If you use a lockfile (package-lock.json or yarn.lock), commit the updated file.
Audit every place cg.parse() is called in your codebase. Search your repository for cg.parse, codegen.parse, and any wrapper functions around them. Flag every call site where the input originates from a user request, a URL parameter, a form field, or an external API. Even after patching, understanding your data-flow helps you catch similar patterns in other libraries.
Check your transitive dependencies for indirect exposure. You might not use math-codegen directly, but a library you depend on might. Run npm audit to surface any known-vulnerable versions in your dependency tree. For a more thorough audit, tools like npm ls math-codegen will show you every package in your tree that pulls it in. If a third-party dependency is the culprit and hasn't patched yet, consider temporarily removing that feature or adding a server-side input blocklist while you wait for an upstream fix.

CVE-2026-41507 | CVSS 9.8 Critical | Affected: math-codegen < 0.4.3 | Fixed: math-codegen 0.4.3 | Platform: Cross-platform (Node.js)