{"id":"EUVD-2026-28597","enisaUuid":"19e33ef8-78a6-3b38-be87-0b67a0cdcd36","description":"math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.","datePublished":"May 8, 2026, 1:49:34 PM","dateUpdated":"May 8, 2026, 2:20:21 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xf-cc4r\nhttps://github.com/mauriciopoppe/math-codegen/pull/11\nhttps://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b\n","aliases":"CVE-2026-41507\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"afaf5e29-122f-3e02-9250-d88ad39697f2","product":{"name":"math-codegen","vendor":{"name":"mauriciopoppe"}},"product_version":"\u003c 0.4.3"}],"enisaIdVendor":[{"id":"8546e630-57ee-3e14-a614-ceb97c46ffae","vendor":{"name":"mauriciopoppe"}}],"enisaIdVulnerability":[{"id":"5bdd2531-68e4-3804-ab86-b6ed8ac603c6","vulnerability":{"id":"CVE-2026-41507","description":"math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE. This issue has been patched in version 0.4.3.","datePublished":"May 8, 2026, 1:49:34 PM","dateUpdated":"May 8, 2026, 2:20:21 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xf-cc4r\nhttps://github.com/mauriciopoppe/math-codegen/pull/11\nhttps://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b\n","enisa_id":"EUVD-2026-28597\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Nov 7, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"09721878-e894-3444-bbb7-1f5c75962c43","product":{"name":"math-codegen","vendor":{"name":"mauriciopoppe"}},"product_version":"\u003c 0.4.3"}],"vulnerabilityVendor":[{"id":"6ae0b7a3-7c24-3a55-a5b1-df7ff65d84a3","vendor":{"name":"mauriciopoppe"}}]}}],"enisaIdAdvisory":[]}