PT-2026-35630 · Npm · Math-Codegen

Publicado 2026-04-17 · Atualizado 2026-04-17

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact

String literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE.

Patches

The vulnerability is addressed by using JSON.stringify() on string literal values in lib/node/ConstantNode.js to ensure they are treated as data rather than code. Users should upgrade to version 0.4.3 or later.

Workarounds

Avoid passing un-sanitized user input to the parser or manually escape string literals in the input.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

GHSA-P6X5-P4XF-CC4R

Produtos afetados

Math-Codegen

Referências · 5

• https://github.com/mauriciopoppe/math-codegen · Nota
• https://github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xf-cc4r · Nota
• https://github.com/mauriciopoppe/math-codegen/pull/11 · Nota
• https://github.com/hits3134 · Nota
• https://osv.dev/vulnerability/GHSA-p6x5-p4xf-cc4r · Aviso do Fabricante