Skip to content
OpenAdvisories

Package · npm

math-codegen

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Critical 9.8
    CVE-2026-41507

    Remote Code Execution (RCE) via String Literal Injection into math-codegen

    math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands w…

    mauriciopoppe math-codegen math-codegen npm