GHSA-p6x5-p4xf-cc4r

Source

https://github.com/advisories/GHSA-p6x5-p4xf-cc4r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p6x5-p4xf-cc4r/GHSA-p6x5-p4xf-cc4r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p6x5-p4xf-cc4r

Aliases

CVE-2026-41507

Published

2026-04-17T22:31:45Z

Modified

2026-05-12T17:16:37Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Remote Code Execution (RCE) via String Literal Injection into math-codegen

Details

Impact

String literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE.

Patches

The vulnerability is addressed by using JSON.stringify() on string literal values in lib/node/ConstantNode.js to ensure they are treated as data rather than code. Users should upgrade to version 0.4.3 or later.

Workarounds

Avoid passing un-sanitized user input to the parser or manually escape string literals in the input.

Database specific

{
    "cwe_ids":  [
        "CWE-94"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-17T22:31:45Z",
    "nvd_published_at":  "2026-05-08T14:16:34Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / math-codegen

Package

Name: math-codegen; View open source insights on deps.dev
Purl: pkg:npm/math-codegen

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.4.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-p6x5-p4xf-cc4r/GHSA-p6x5-p4xf-cc4r.json"