PT-2026-37126 · Npm · Math-Codegen

Hits313 + 1 · Published 2026-04-17 · Updated 2026-05-12 · CVE-2026-41507

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions math-codegen versions prior to 0.4.3

Description String literal content passed to the cg.parse() function is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Applications exposing a math evaluation endpoint where user input flows into cg.parse() are susceptible to remote code execution (RCE), which is the ability to execute malicious code on a remote machine.

Recommendations Update to version 0.4.3 or later. Avoid passing un-sanitized user input to the parser or manually escape string literals in the input.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-41507

GHSA-P6X5-P4XF-CC4R

Affected Products

Math-Codegen

References · 11

• https://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b · Patch
• https://github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xf-cc4r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41507 · Security Note
• https://osv.dev/vulnerability/GHSA-p6x5-p4xf-cc4r · Vendor Advisory
• https://github.com/mauriciopoppe/math-codegen/pull/11 · Note
• https://github.com/mauriciopoppe/math-codegen · Note
• https://twitter.com/lyrie_ai/status/2054322458086293594 · Twitter Post
• https://github.com/hits3134 · Note
• https://twitter.com/lyrie_ai/status/2054322460082712653 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054322457163522328 · Twitter Post
• https://twitter.com/CVEnew/status/2052811023132787197 · Twitter Post