CVE-2026-41507: Remote Code Execution (RCE) via String Literal Injection into math-codegen
(updated )
String literal content passed to cg.parse() is injected verbatim into a new Function() body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into cg.parse() is vulnerable to full RCE.
References
- github.com/advisories/GHSA-p6x5-p4xf-cc4r
- github.com/hits3134
- github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b
- github.com/mauriciopoppe/math-codegen/pull/11
- github.com/mauriciopoppe/math-codegen/security/advisories/GHSA-p6x5-p4xf-cc4r
- nvd.nist.gov/vuln/detail/CVE-2026-41507
Code Behaviors & Features
Detect and mitigate CVE-2026-41507 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →