Vulnerability Description
math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mauriciopoppe | Math-Codegen | < 0.4.3 |
Related Weaknesses (CWE)
References
- https://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd9Patch
- https://github.com/mauriciopoppe/math-codegen/pull/11Issue Tracking
- https://github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xfVendor Advisory
FAQ
What is CVE-2026-41507?
CVE-2026-41507 is a vulnerability with a CVSS score of 9.8 (CRITICAL). math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. Thi...
How severe is CVE-2026-41507?
CVE-2026-41507 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-41507?
Check the references section above for vendor advisories and patch information. Affected products include: Mauriciopoppe Math-Codegen.