EUVD-2026-28597
GHSA-p6x5-p4xf-cc4r
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Blast Radius
ecosystem impact- 15 npm packages depend on math-codegen (2 direct, 13 indirect)
Ecosystem-wide dependent count for version 0.4.3.
DescriptionNVD
math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.
AnalysisAI
Remote code execution in math-codegen npm package versions prior to 0.4.3 allows unauthenticated attackers to execute arbitrary system commands via string literal injection into the cg.parse() function. The vulnerability stems from unsanitized string literals being injected directly into new Function() bodies, enabling full command execution on any application exposing math evaluation endpoints that process user input. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all applications and services using math-codegen npm package and identify current versions in use; isolate or disable any exposed math evaluation endpoints. Within 7 days: Upgrade math-codegen to version 0.4.3 or later across all affected applications and redeploy. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today