Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-41507Remote Code Execution (RCE) via String Literal Injection into math-codegen

Critical 9.8

In plain English

A critical-severity code injection in math-codegen from mauriciopoppe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	math-codegen	0.4.3	GHSA-p6x5-p4xf-cc4r

Affected products (as reported)

Vendor	Product	Versions
mauriciopoppe	math-codegen	< 0.4.3

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xf-cc4r x_refsource_CONFIRM
https://github.com/mauriciopoppe/math-codegen/pull/11 x_refsource_MISC
https://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b x_refsource_MISC